Page MenuHomePhabricator

Grant LDAP groups and deployment shell access to Kevin Bazira
Closed, ResolvedPublic

Description

Username: kevinbazira
Full name: Kevin Bazira
https://wikitech.wikimedia.org/wiki/User:Kevin_Bazira

He'll need access to nda, wmf, analytics-privatedata-users, statistics-privatedata-users, wikidev, deployment-prep, deployment, deploy-service, and ores-admin.

Kevin needs this access in order to train and test models on analytics-hosted data (analytics-privatedata-users`, `statistics-privatedata-users), to make deployments of ORES (ores-admin, deployment, deployment-prop, and deploy-service).


SRE Clinic Duty Checklist for Access Requests

Most requirements are outlined on https://wikitech.wikimedia.org/wiki/Requesting_shell_access

This checklist should be used on all access requests to ensure that all steps are covered. This includes expansion to access. Please do not check off items on the list below unless you are in Ops and have confirmed the step.

  • User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • User has a valid NDA on file with WMF legal. (This can be checked by Operations via the NDA tracking sheet & is included in all WMF Staff/Contractor hiring.)
  • User has provided the following: wikitech username, preferred shell username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform.
  • User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not share with any other service (this includes not sharing with WMCS access, no shared keys.)
  • access request (or expansion) has sign off of WMF sponsor/manager (sponser for volunteers, manager for wmf staff)
  • non-sudo requests: 3 business day wait must pass with no objections being noted on the task
  • Patchset for access request

Event Timeline

Restricted Application added a subscriber: Aklapper. · View Herald Transcript
Dzahn subscribed.

adding SRE-Access-Requests because it's more than just LDAP. Involves also shell access.

Dzahn renamed this task from Grant LDAP to Kevinbazira to Grant LDAP groups and deployment shell access to Kevinbazira.Oct 1 2019, 5:19 PM
Dzahn renamed this task from Grant LDAP groups and deployment shell access to Kevinbazira to Grant LDAP groups and deployment shell access to Kevin Bazira.
Dzahn triaged this task as Medium priority.
Ottomata updated the task description. (Show Details)

@kevinbazira could you please review and sign the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document, add details to the task description outlining high level reasoning for the access, and coordinate a comment of approval from your manager?

After that we'll need to seek additional approvals from department managers for some of the groups, specifically analytics and deployment.

Thanks in advance!

herron updated the task description. (Show Details)
herron moved this task from Backlog to Awaiting User Input on the LDAP-Access-Requests board.
herron moved this task from Untriaged to Awaiting User Input on the SRE-Access-Requests board.

I've updated the task details with some high-level reasoning for the access. If it's not evident, I approve of this request as Kevin's manager and the lead for ORES/Scoring Platform.

Thanks @Halfak,

@herron, I've signed the L3 agreement document, and below is my user information:

wikitech username: Kevin Bazira
preferred shell username: kevinbazira
email address: kvnbzr@gmail.com
high level reasoning for the access: please see @Halfak's comment above.

If there is something else missing, please let me know. I'll be happy to provide it.

Thanks!

Great, thank you!

@Nuria could you please review/approve for analytics groups?

@greg could you please review/approve for deploy groups?

@greg could you please review/approve for deploy groups?

+1

Let's see, is kevinbazira a staff member? if so he only needs access to LDAP 'wmf' group. nda is not needed, wmf is for employees, nda is for collaborators/contractors/other chapters.

In order to access data in hadoop and work on stats machines he would only need access to analytics-privatedata-users.

statistics-privatedata-users is for access to mariaDB mediawiki data. Is that also needed?

Yes he is staff. He'll be pulling data from MariaDB for use training ORES models.

Ok, approved for wmf, analytics-privatedata-users, statistics-privatedata-users on my end

Change 545418 had a related patch set uploaded (by Cwhite; owner: Cwhite):
[operations/puppet@production] admin: add Kevin Bazira to several groups

https://gerrit.wikimedia.org/r/545418

Hi @kevinbazira!

It looks like your email address in wikitech is not updated to your staff address. Would you please correct this then we can proceed?
The place to change it is here: https://wikitech.wikimedia.org/wiki/Special:Preferences

Thanks!

Hi @colewhite!

I have updated my email address in wikitech to my staff address: kbazira@wikimedia.org

Thanks!

Hi @colewhite, I'm re-assigning to you given that I think we've done all we can from our end.

Change 545418 merged by Cwhite:
[operations/puppet@production] admin: add Kevin Bazira to several groups

https://gerrit.wikimedia.org/r/545418

The necessary changes have been deployed. Please let me know if you encounter any related issue.