Page MenuHomePhabricator

Analytics Access for Grant (groups cn=wmf and analytics-privatedata-users)
Closed, ResolvedPublic

Description

Please grant Grant access to the analytics dashboards (Turnillo?)

Requested groups:
wmf (LDAP)
analytics-privatedata-users

Full Name: Grant Ingersoll
Developer Access Username: gsingers
Public ED25519 key: AAAAC3NzaC1lZDI1NTE5AAAAIISv18qbNemqdao4YBxgt881oWOeKJp3tKg0Ke6eRYwm
Reason: Understanding our analytics architecture and key capabilities.

SRE Clinic Duty Checklist for Access Requests

Most requirements are outlined on https://wikitech.wikimedia.org/wiki/Requesting_shell_access

This checklist should be used on all access requests to ensure that all steps are covered. This includes expansion to access. Please do not check off items on the list below unless you are in Ops and have confirmed the step.

  • - User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • - User has a valid NDA on file with WMF legal. (This can be checked by Operations via the NDA tracking sheet & is included in all WMF Staff/Contractor hiring.)
  • - User has provided the following: wikitech username, preferred shell username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
  • - User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not share with any other service (this includes not sharing with WMCS access, no shared keys.)
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponser for volunteers, manager for wmf staff)
  • - non-sudo requests: 3 business day wait must pass with no objections being noted on the task
  • - Patchset for access request

Event Timeline

JAllemandou moved this task from Incoming to Ops Week on the Analytics board.
JAllemandou added a project: Analytics-Kanban.

@gsingers In order to get an ldap user you need to create a user at http://wikitech.wikimedia.org , paste that user in this ticket once you have it, someone from SRE-Access-Requests would verify your employment with WMF and you shall be added to the group that can access internal data and tools.

ping SRE-Access-Requests after verification of employment (grant is our new CTO) his user should be added to the wmf ldap group

Doesn't this technically need Katherine to sign it off?

@Reedy not sure if you are for real but while "technically" that might be a requirement I vote for proceeding w/o it in this case so as not to have to wait months for this to proceed.

ping @herron (who i think is on clinic duty this week) , this access does not need ssh keys , just adding user to wmf ldap group.

Grant is also going to get shell access so he will be pasting his public ssh keys, here is how to do that https://phabricator.wikimedia.org/T235260

I cc'd Katherine and @herron on an email, and she has approved.

Full Name: Grant Ingersoll
Developer Access Username: gsingers
Public ED25519 key: AAAAC3NzaC1lZDI1NTE5AAAAIISv18qbNemqdao4YBxgt881oWOeKJp3tKg0Ke6eRYwm
Reason: Understanding our analytics architecture and key capabilities.

Dzahn added a subscriber: Nuria.
Dzahn subscribed.

We'll need to know which groups from https://wikitech.wikimedia.org/wiki/Analytics/Data_access#Access_Groups are requested

There are different types of shell access.

The group would be
analytics-privatedata-users

Change 544197 had a related patch set uploaded (by Herron; owner: Herron):
[operations/puppet@production] admin: add gsingers to analytics-privatedata-users group

https://gerrit.wikimedia.org/r/544197

herron renamed this task from Analytics Access for Grant to Analytics Access for Grant (groups cn=wmf and analytics-privatedata-users).Oct 18 2019, 2:10 PM
herron added a project: LDAP-Access-Requests.
herron updated the task description. (Show Details)

Hello! @gsingers, as a last step could you please review and sign the L3 document? Once that's done (and the related patch has a +1 from a peer within SRE) we'll be ready to merge and deploy analytics-privatedata-users group membership.

In the mean time I've added gsingers to LDAP group wmf

Thanks in advance!

Once that patch is merged, you can try

https://turnilo.wikimedia.org and https://superset.wikimedia.org for visual tools

to ssh to stat1007.eqiad.wmnet and type > hive;

Once that patch is merged, you can try

https://turnilo.wikimedia.org and https://superset.wikimedia.org for visual tools

This should already work now, before the patch, because of:

In the mean time I've added gsingers to LDAP group wmf

oohhh, nice thank you! @gsingers please try https://turnilo.wikimedia.org and let us know whether you can access

Dzahn updated the task description. (Show Details)

L3 has been signed. This is unblocked.

Change 544197 merged by Cwhite:
[operations/puppet@production] admin: add gsingers to analytics-privatedata-users group

https://gerrit.wikimedia.org/r/544197

Account deployed and checked Grant is in wmf ldap group. Please let me know if you encounter any related issue.