+1. We talked about this and in the past i have often ran queries for Andre for things like community metrics.

@DBA fyi. I suggest i can puppetize that Andre gets a my.cnf written to his home dir somewhere with the existing "metrics_user" from the class "passwords::mysql::phabricator".

That's the user i also use to run queries like this. It matches the purpose because metrics is what we are getting here. Of course we do NOT want to use the "app_user" or "manifest_user" and i want to point out they are already separate. It's not like there is just a single phab mysql user.

This way you don't have to create any new GRANTs and i can resolve it without changes on the DB side. (edit: well... replace "somewhere" with "phab server").

Change 551268 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] phabricator: write my.cnf for db access into each admin home dir

https://gerrit.wikimedia.org/r/551268

Dzahn rightfully pointed out that Phabricator uses quite some DBs. If I had to limit, my list would probably be:

| phabricator_conpherence  |
| phabricator_differential |
| phabricator_file         |
| phabricator_herald       |
| phabricator_maniphest    |
| phabricator_policy       |
| phabricator_project      |
| phabricator_user         |

Not sure about these:

| phabricator_badges       |
| phabricator_spaces       |

The user @Dzahn suggests to use I believe it is phstats, which only has access to these databases:

phabricator_differential
phabricator_user
phabricator_project
phabricator_maniphest

That's also my understanding of the minimum "core databases" I'd need. So let's go with those four (plus principle of least privilege).
Could still expand as/if use cases pop up.

@Aklapper Given that Phabricator uses multiple databases, do you just need the "phabricator_maniphest"

In T238425#5670176, @Marostegui wrote:

The user @Dzahn suggests to use I believe it is phstats, which only has access to these databases:

Yes, that's correct. The variable $metrics_user is set to "phstats".

In T238425#5671202, @Aklapper wrote:

That's also my understanding of the minimum "core databases" I'd need. So let's go with those four (plus principle of least privilege).

Ok, great. That makes it easier. Doing that.

Change 551268 merged by Dzahn:
[operations/puppet@production] phabricator: write my.cnf for db access into each admin home dir

https://gerrit.wikimedia.org/r/551268

[phab1001:/home/aklapper] $ mysql
ERROR 2002 (HY000): Can't connect to local MySQL server through socket '/var/run/mysqld/mysqld.sock' (2)
[phab1001:/home/aklapper] $ sudo su aklapper
aklapper@phab1001:~$ mysql
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 5455428
Server version: 10.1.39-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [phabricator_maniphest]>

@Aklapper See above. Puppet has written a .my.cnf into your home (and that of Greg) now and if i run "mysql" i can't connect but if i become you first and then just run "mysql" i am straight on the phabricator_maniphest DB.

You can switch to the other databases we idenitified with "use" after you connected. For example the "_user" db is accessible but "_herald" is not, as expected:

MariaDB [phabricator_maniphest]> use phabricator_herald;
ERROR 1044 (42000): Access denied for user 'phstats'@'10.64.16.8' to database 'phabricator_herald'
MariaDB [phabricator_maniphest]> use phabricator_user;
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Database changed

@Dzahn: Uh yay! Works! Thanks so much! <3

Change 555551 had a related patch set uploaded (by Dzahn; owner: Dzahn):
[operations/puppet@production] phabricator: limit mysql access for admins to production realm

https://gerrit.wikimedia.org/r/555551

Change 555551 merged by Dzahn:
[operations/puppet@production] phabricator: limit mysql access for admins to production realm

https://gerrit.wikimedia.org/r/555551