Page MenuHomePhabricator
Create Task
Maniphest T221225

sssd integration needs to be updated to include sudo config from LDAP support
Closed, ResolvedPublic
Actions

Description

After T218126: LDAP: try how sssd works with our servers we agreed on deploying sssd to more servers in Toolforge.

On 2019-04-17 I deployed sssd to the bastions and some users reported they were unable to become their tools.

Details

ProjectBranchLines +/-Subject
operations/puppetproduction+85 -57sudo: decouple sudo from sudo-ldap
operations/puppetproduction+194 -101sudo: decouple sudo from sudo-ldap
operations/puppetproduction+136 -78sudo: decouple sudo from sudo-ldap
operations/puppetproduction+78 -136Revert "sudo: decouple sudo from sudo-ldap"
operations/puppetproduction+26 -20cloudvps: introduce proper base role/profile for VM instances
operations/puppetproduction+13 -5vagrant: refactor roles into profiles
operations/puppetproduction+15 -6standard: introduce a wrapper profile and use it in CloudVPS
operations/puppetproduction+5 -3standard refactor: remove standard class from base classes
operations/puppetproduction+6 -1ldap: sssd: add missing bits for sudo
operations/puppetproduction+15 -2ldap: Add support for sudo rules in sssd client config
Customize query in gerrit

Related Objects
Search...

Event Timeline

aborrero created this task.Apr 17 2019, 12:05 PM
Stashbot added a comment.Apr 17 2019, 12:09 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-17T12:08:53Z] <arturo> T221225 rebooting bastions to clean sssd. We are back to nscd/nslcd until we figure out what's wrong here

Paladox added a subscriber: Paladox.Apr 17 2019, 12:37 PM
bd808 added a comment.Apr 17 2019, 3:57 PM

The working part of the become script is exec /usr/bin/sudo -niu "$prefix.$tool" "$@". $prefix is 'tools' in the Toolforge project. $tool is the name passed on the command line by the user (for example 'bd808-test').

With the nscd/nslcd implementation of LDAP into our nss stack this works as expected:

$ hostname -f
tools-sgebastion-08.tools.eqiad.wmflabs
$ echo $USER
bd808
$ sudo -niu tools.bd808-test
$ echo $USER
tools.bd808-test

With the sssd implementation, it fails:

$ hostname -f
tools-sgeexec-0901.tools.eqiad.wmflabs
$ echo $USER
bd808
$ sudo -niu tools.bd808-test
sudo: a password is required

This is a missing feature in our current sssd-sudo config. The sudoer rules that allow a Toolforge maintainer to become a given tool live in the LDAP directory. It looks like we currently have this explicitly disabled in the config:

/etc/sssd/sssd.conf
[sssd]
#debug_level=10
domains = wikimedia.org
default_domain_suffix = wikimedia.org
full_name_format = %1$s
services = nss, pam, ssh
config_file_version = 2

# (... cut ...)
[domain/wikimedia.org]
#debug_level=10
id_provider = ldap
auth_provider = ldap
# (... cut ...)
# disable stuff not provided by LDAP (value of id_provider is used by default)
sudo_provider = none
# (... cut ...)

I think we need the sssd equivalent of the nscd/nslcd config from /etc/sudo-ldap.conf added:

/etc/sudo-ldap.conf
BASE            dc=wikimedia,dc=org
URI             ldap://ldap-ro.eqiad.wikimedia.org:389 ldap://ldap-ro.eqiad.wikimedia.org:389
# The next settings are not honored by OpenLDAP but are honored by sudo-ldap and /etc/sudo-ldap.conf is a symlink to /etc/ldap/ldap.conf
BINDDN          cn=proxyagent,ou=profile,dc=wikimedia,dc=org
BINDPW          Eche0ieng8UaNoo
SUDOERS_BASE    ou=sudoers,cn=tools,ou=projects,dc=wikimedia,dc=org
SSL             start_tls
TLS_CHECKPEER   yes
TLS_REQCERT     demand
TLS_CACERTDIR   /etc/ssl/certs
TLS_CACERTFILE  /etc/ssl/certs/ca-certificates.crt
TLS_CACERT      /etc/ssl/certs/ca-certificates.crt

(The LDAP proxy user password here is public intentionally, don't freak out!)

bd808 renamed this task from Toolforge: deploying sssd to bastions to sssd integration needs to be updated to include sudo config from LDAP support.Apr 17 2019, 3:58 PM
Krenair added a subscriber: Krenair.Apr 17 2019, 4:00 PM
gerritbot added a comment.Apr 17 2019, 11:55 PM

Change 504817 had a related patch set uploaded (by BryanDavis; owner: Bryan Davis):
[operations/puppet@production] ldap: Add support for sudo rules in sssd client config

https://gerrit.wikimedia.org/r/504817

gerritbot added a project: Patch-For-Review.Apr 17 2019, 11:55 PM
bd808 moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.Apr 19 2019, 5:38 PM
gerritbot added a comment.Apr 22 2019, 10:23 AM

Change 504817 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] ldap: Add support for sudo rules in sssd client config

https://gerrit.wikimedia.org/r/504817

Stashbot added a comment.Apr 23 2019, 9:41 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T09:41:45Z] <arturo> T221225 disable puppet agent in the bastions

Stashbot added a comment.Apr 23 2019, 9:43 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T09:43:20Z] <arturo> T221225 use profile::ldap::client::labs::client_stack: sssd in the puppet bastion prefix

Stashbot added a comment.Apr 23 2019, 9:49 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T09:49:22Z] <arturo> T221225 run puppet agent in the bastions and reboot them with sssd

aborrero closed this task as Resolved.Apr 23 2019, 9:53 AM

It seems to work.

aborrero@tools-sgebastion-07:~$ sudo -niu tools.bd808-test
tools.bd808-test@tools-sgebastion-07:~$ logout

aborrero@tools-sgebastion-07:~$ become arturo-test-tool
tools.arturo-test-tool@tools-sgebastion-07:~$

Please reopen if there are any other issue.

aborrero reopened this task as Open.Apr 23 2019, 10:15 AM

Still problems:

aborrero@tools-sgebastion-07:~$ sudo su eugene233
eugene233@tools-sgebastion-07:~$ become isa 
sudo: a password is required
Stashbot added a comment.Apr 23 2019, 10:16 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T10:16:32Z] <arturo> T221225 disable puppet in tools-sgebastion-08 for sssd testing

Stashbot added a comment.Apr 23 2019, 10:27 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T10:27:50Z] <arturo> T221225 rebooting tools-sgebastion-07 to clean sssd confiuration

Stashbot added a comment.Apr 23 2019, 10:28 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T10:28:02Z] <arturo> T221225 use profile::ldap::client::labs::client_stack: classic in the puppet bastion prefix

aborrero added a comment.Apr 23 2019, 10:44 AM

I'm currently live-hacking tools-sgebastion-08, debugging sssd I see some weird messages:

(Tue Apr 23 10:38:27 2019) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'tools.isa' matched without domain, user is tools.isa
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [wikimedia.org]
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [calc_flat_name] (0x0080): Flat name requested but domain has noflat name set, falling back to domain name
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [calc_flat_name] (0x0080): Flat name requested but domain has noflat name set, falling back to domain name
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [calc_flat_name] (0x0080): Flat name requested but domain has noflat name set, falling back to domain name
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [calc_flat_name] (0x0080): Flat name requested but domain has noflat name set, falling back to domain name
(Tue Apr 23 10:38:27 2019) [sssd[be[wikimedia.org]]] [dp_get_account_info_handler] (0x0200): Got request for [0x2][BE_REQ_GROUP][idnumber=54010]
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): name 'tools.isa' matched without domain, user is tools.isa
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [sss_parse_name_for_domains] (0x0200): using default domain [wikimedia.org]
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [client_recv] (0x0200): Client disconnected!
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [get_client_cred] (0x0080): The following failure is expected to happen in case SELinux is disabled:
SELINUX_getpeercon failed [92][Protocol not available].
Please, consider enabling SELinux in your system.
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [sss_cmd_get_version] (0x0200): Received client version [1].
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [sss_cmd_get_version] (0x0200): Offered version [1].
(Tue Apr 23 10:38:27 2019) [sssd[be[wikimedia.org]]] [dp_get_account_info_handler] (0x0200): Got request for [0x2][BE_REQ_GROUP][idnumber=500]
(Tue Apr 23 10:38:27 2019) [sssd[be[wikimedia.org]]] [sysdb_set_entry_attr] (0x0200): Entry [name=tools.isa@wikimedia.org,cn=groups,cn=wikimedia.org,cn=sysdb] has set [ts_cache] attrs.
(Tue Apr 23 10:38:27 2019) [sssd[be[wikimedia.org]]] [sysdb_set_entry_attr] (0x0200): Entry [name=wikidev@wikimedia.org,cn=groups,cn=wikimedia.org,cn=sysdb] has set [ts_cache] attrs.
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [calc_flat_name] (0x0080): Flat name requested but domain has noflat name set, falling back to domain name
(Tue Apr 23 10:38:27 2019) [sssd[nss]] [calc_flat_name] (0x0080): Flat name requested but domain has noflat name set, falling back to domain name
[...]

The Flat name requested but domain has noflat name set, falling back to domain name entry is repeated many many times.

What I'm doing for testing is:

root@tools-sgebastion-08-# sudo su eugene233

eugene233@tools-sgebastion-08:~$ become isa
sudo: a password is required

eugene233@tools-sgebastion-08:~$ sudo -niu tools.isa
sudo: a password is required
gerritbot added a comment.Apr 23 2019, 12:42 PM

Change 505761 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] ldap: sssd: add missing bits for sudo

https://gerrit.wikimedia.org/r/505761

aborrero added a comment.Apr 23 2019, 12:44 PM

With the patch https://gerrit.wikimedia.org/r/505761 I can do this:

aborrero@tools-sgebastion-08:~$ sudo su eugene233

eugene233@tools-sgebastion-08:~$ sudo -niu tools.isa

tools.isa@tools-sgebastion-08:~$ logout

eugene233@tools-sgebastion-08:~$ become isa

tools.isa@tools-sgebastion-08:~$ logout
gerritbot added a comment.Apr 23 2019, 12:52 PM

Change 505761 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] ldap: sssd: add missing bits for sudo

https://gerrit.wikimedia.org/r/505761

Stashbot added a comment.Apr 23 2019, 12:57 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T12:57:37Z] <arturo> T221225 use profile::ldap::client::labs::client_stack: sssd in the puppet bastion prefix, try again with sssd in the bastions, reboot them

Stashbot added a comment.Apr 23 2019, 1:06 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T13:06:00Z] <arturo> T221225 use profile::ldap::client::labs::client_stack: classic in the puppet bastion prefix, again. Rollback again.

aborrero added a comment.Apr 23 2019, 1:16 PM

Well, I suspect the sudo vs sudo-ldap package is causing some confusion here. In the live hacking I was doing in tools-sgebastion-08 I installed sudo and deleted sudo-ldap.

More testing is required before sssd can be deployed to the bastions.

Stashbot added a comment.Apr 23 2019, 3:19 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T15:19:17Z] <arturo> T221225 creating tools-sgebastion-09 for testing sssd stuff

Stashbot added a comment.Apr 23 2019, 3:26 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T15:26:50Z] <arturo> T221225 rebooting tools-sgebastion-08 to cleanup sssd

bd808 added a comment.EditedApr 24 2019, 12:35 AM
In T221225#5130979, @Stashbot wrote:

Mentioned in SAL (#wikimedia-cloud) [2019-04-23T15:19:17Z] <arturo> T221225 creating tools-sgebastion-09 for testing sssd stuff

The scheduler apparently picked one of the same cloudvirts for this as one of the current bastions. It triggered https://icinga.wikimedia.org/cgi-bin/icinga/extinfo.cgi?type=2&host=cloudcontrol1003&service=tools+project+instance+distribution. I ack'ed the alert and downtimed it for 2 days so you can have a chance to move it to another cloudvirt or finish testing and rm the instance.

[00:32]  <icinga-wm>	ACKNOWLEDGEMENT - tools project instance distribution on cloudcontrol1003 is CRITICAL: CRITICAL: sgebastion class instances not spread out enough BryanDavis New instance added for testing, needs to be placed on a different cloudvirt manually. - The acknowledgement expires at: 2019-04-26 00:31:10. https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS/Admin/Troubleshooting
Stashbot added a comment.Apr 24 2019, 9:18 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-24T09:18:54Z] <arturo> T221225 reallocating tools-sgebastion-09 to cloudvirt1008

Stashbot added a comment.Apr 25 2019, 12:49 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-25T12:49:32Z] <arturo> T221225 using profile::ldap::client::labs::client_stack: sssd in horizon for tools-sgebastion-09 (testing)

gerritbot added a comment.Apr 25 2019, 2:28 PM

Change 506435 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] sssd: sudo: don't install sudo-ldap if using sssd

https://gerrit.wikimedia.org/r/506435

gerritbot added a comment.Apr 26 2019, 9:59 AM

Change 506614 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] standard: refactor into a profile

https://gerrit.wikimedia.org/r/506614

gerritbot added a comment.Apr 26 2019, 2:22 PM

Change 506682 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] standard refactor: remove standard class from base classes

https://gerrit.wikimedia.org/r/506682

aborrero triaged this task as Medium priority.Apr 26 2019, 4:02 PM
aborrero moved this task from Triage to In Progress on the Toolforge board.
gerritbot added a comment.Apr 29 2019, 9:35 AM

Change 506682 merged by Jbond:
[operations/puppet@production] standard refactor: remove standard class from base classes

https://gerrit.wikimedia.org/r/506682

gerritbot added a comment.Apr 29 2019, 10:02 AM

Change 506614 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] standard: introduce a wrapper profile and use it in CloudVPS

https://gerrit.wikimedia.org/r/506614

Stashbot added a comment.Apr 29 2019, 10:20 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-29T10:20:58Z] <arturo> disable puppet in all servers to livehack tools-puppetmaster-01 to test T221225

Stashbot added a comment.Apr 29 2019, 10:27 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-29T10:27:52Z] <arturo> T221225 reboot tool-sgebastion-09 for testing sssd

gerritbot added a comment.Apr 29 2019, 11:21 AM

Change 506979 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] cloudvps: introduce proper base role/profile for VM instances

https://gerrit.wikimedia.org/r/506979

Stashbot added a comment.Apr 29 2019, 11:22 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-29T11:22:16Z] <arturo> T221225 re-enable puppet agent in all toolforge servers

gerritbot added a comment.Apr 29 2019, 12:18 PM

Change 507005 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] vagrant: refactor roles into profiles

https://gerrit.wikimedia.org/r/507005

aborrero added subscribers: jbond, MoritzMuehlenhoff.Apr 29 2019, 12:34 PM

My plans are:

  • decouple sudo from sudo-ldap at module level, i.e, at modules/sudo/manifests/ level. So we have ::sudo and ::sudo::sudo-ldap.
  • introduce support in sudo::user and sudo::group for this new decoupling. They are now aware of the different flavors, defaulting to ::sudo (prod preferred).
  • introduce a global hiera key sudo_flavor which can be used in profiles to select which sudo flavor we need. By default, in prod, ::sudo is preferred, in labs ::sudo::sudo-ldap is preferred.
  • by default, all VMs use sudo-ldap flavor (behaviour untouched) until we switch to sssd, in which case we start using the sudo flavor instead.
  • a VM using sssd will need 2 hiera keys:
profile::ldap::client::labs::client_stack: sssd
sudo_flavor: sudo
  • with time, when enough VMs are using this config, we can simply switch the defaults, and probably simplify a bit the puppet code

I needed to refactor some callers of sudo::user and sudo::group to be able to introduce hiera keys, that's why the additional patches.

Relevant patches, in order, are (skipping some already merged ones):

Please @bd808 @Andrew @Bstorm @MoritzMuehlenhoff @jbond review if this plan makes sense.

gerritbot added a comment.Apr 30 2019, 10:41 AM

Change 507005 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] vagrant: refactor roles into profiles

https://gerrit.wikimedia.org/r/507005

gerritbot added a comment.Apr 30 2019, 10:46 AM

Change 506979 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] cloudvps: introduce proper base role/profile for VM instances

https://gerrit.wikimedia.org/r/506979

Stashbot added a comment.Apr 30 2019, 10:56 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-30T10:56:32Z] <arturo> T221225 create tools-sgebastion-0test for more sssd tests

Stashbot added a comment.Apr 30 2019, 11:07 AM

Mentioned in SAL (#wikimedia-cloud) [2019-04-30T11:07:19Z] <arturo> T221225 disable puppet in toolforge

gerritbot added a comment.Apr 30 2019, 12:40 PM

Change 506435 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] sudo: decouple sudo from sudo-ldap

https://gerrit.wikimedia.org/r/506435

Stashbot added a comment.Apr 30 2019, 12:45 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-30T12:45:11Z] <arturo> adding sudo_flavor: sudo hiera config to all puppet prefixes with sssd (T221225)

Stashbot added a comment.Apr 30 2019, 12:50 PM

Mentioned in SAL (#wikimedia-cloud) [2019-04-30T12:50:43Z] <arturo> enable puppet in all servers T221225

gerritbot added a comment.Apr 30 2019, 1:15 PM

Change 507317 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] Revert "sudo: decouple sudo from sudo-ldap"

https://gerrit.wikimedia.org/r/507317

gerritbot added a comment.Apr 30 2019, 1:18 PM

Change 507317 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] Revert "sudo: decouple sudo from sudo-ldap"

https://gerrit.wikimedia.org/r/507317

Stashbot added a comment.Apr 30 2019, 4:52 PM

Mentioned in SAL (#wikimedia-operations) [2019-04-30T16:52:26Z] <arturo> merging change to profile::base and ::raid https://gerrit.wikimedia.org/r/c/operations/puppet/+/507357 related to T221225

gerritbot added a comment.Apr 30 2019, 5:07 PM

Change 507376 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] Revert "Revert "sudo: decouple sudo from sudo-ldap""

https://gerrit.wikimedia.org/r/507376

Stashbot added a comment.May 6 2019, 10:53 AM

Mentioned in SAL (#wikimedia-cloud) [2019-05-06T10:53:54Z] <arturo> T221225 disable puppet in all toolforge servers for testing sssd patch (puppetmaster livehack)

gerritbot added a comment.May 6 2019, 11:16 AM

Change 507376 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] sudo: decouple sudo from sudo-ldap

https://gerrit.wikimedia.org/r/507376

Stashbot added a comment.May 6 2019, 11:34 AM

Mentioned in SAL (#wikimedia-cloud) [2019-05-06T11:34:23Z] <arturo> T221225 reenable puppet

gerritbot added a comment.May 6 2019, 11:47 AM

Change 508311 had a related patch set uploaded (by Arturo Borrero Gonzalez; owner: Arturo Borrero Gonzalez):
[operations/puppet@production] sudo: decouple sudo from sudo-ldap

https://gerrit.wikimedia.org/r/508311

aborrero added a subtask: T223067: sudo is still broken on certain toolforge hosts.May 13 2019, 1:07 PM
bd808 mentioned this in T217280: LDAP server running out of memory frequently and disrupting Cloud VPS clients.May 19 2019, 12:42 PM
aborrero moved this task from Doing to Blocked on the cloud-services-team (Kanban) board.May 20 2019, 12:08 PM
gerritbot added a comment.May 28 2019, 11:24 AM

Change 508311 merged by Arturo Borrero Gonzalez:
[operations/puppet@production] sudo: decouple sudo from sudo-ldap

https://gerrit.wikimedia.org/r/508311

Maintenance_bot removed a project: Patch-For-Review.May 28 2019, 12:11 PM
Stashbot added a comment.May 28 2019, 12:16 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T12:16:36Z] <arturo> T221225 set sssd/sudo in the hiera config for the tools-sgebastion prefix, and reboot tools-sgebastion-07/08

Stashbot added a comment.May 28 2019, 12:27 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T12:27:06Z] <arturo> T221225 set sssd/sudo in the hiera config for the tools-docker-registry prefix, and reboot tools-docker-registry-[03-04]

Stashbot added a comment.May 28 2019, 12:31 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T12:31:31Z] <arturo> T221225 set sssd/sudo in the hiera config for the tools-checker prefix, and reboot tools-checker-03

Stashbot added a comment.May 28 2019, 12:39 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T12:39:50Z] <arturo> T221225 disable puppet in all tools-worker nodes in preparation for sssd

Stashbot added a comment.May 28 2019, 1:04 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T13:04:48Z] <arturo> T221225 depool and rebooted tools-worker-1001 in preparation for sssd migration

Stashbot added a comment.May 28 2019, 5:08 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T17:07:59Z] <arturo> T221225 switch to sssd/sudo in puppet prefix for tools-worker

Stashbot added a comment.May 28 2019, 5:09 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T17:09:51Z] <arturo> T221225 depool & switch to sssd/sudo & reboot & repool tools-worker-1001

Stashbot added a comment.May 28 2019, 5:12 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T17:12:55Z] <arturo> T221225 depool & switch to sssd/sudo & reboot & repool tools-worker-1002

Stashbot added a comment.May 28 2019, 5:27 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T17:26:55Z] <arturo> T221225 hard reboot tools-worker-1001

Stashbot added a comment.May 28 2019, 5:35 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T17:35:12Z] <arturo> T221225 hard reboot tools-worker-1001 again

Stashbot added a comment.May 28 2019, 5:44 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T17:44:21Z] <arturo> T221225 back to classic/ldap hiera config in the tools-worker puppet prefix

Stashbot added a comment.May 28 2019, 5:49 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T17:49:12Z] <arturo> T221225 repool tools-worker-1002 (using nscd/nslcd and sudoldap)

Stashbot added a comment.May 28 2019, 6:13 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T18:13:20Z] <arturo> T221225 created tools-worker-1029 to test sssd/sudo stuff

Stashbot added a comment.May 28 2019, 6:15 PM

Mentioned in SAL (#wikimedia-cloud) [2019-05-28T18:15:06Z] <arturo> T221225 for the record, tools-worker-1001 is not working after trying with sssd

Stashbot added a comment.May 29 2019, 10:13 AM

Mentioned in SAL (#wikimedia-cloud) [2019-05-29T10:13:36Z] <arturo> enroll the tools-worker-1029 VM into toolforge k8s, but leave it cordoned for sssd testing purposes (T221225)

aborrero closed this task as Resolved.May 29 2019, 11:06 AM

Well. Closing this task now, since we do have sudo support now. Will open other tasks for the other issues we have.

aborrero closed subtask T223067: sudo is still broken on certain toolforge hosts as Resolved.May 29 2019, 11:09 AM
Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL