See also T235708: Redesign for wmcs custom puppet settings (editallhiera removed as part of that task)

@DannyS712 Yes to everything else (as far as I understand it), but I suggest removing/rewriting the part of the description that says "... merging with local stewards ...", because there is still a hope/plan to make wikitech part of SUL someday (T161859 et al), in which case that merge would cause an additional & unnecessary complication.

I think we can just remove the cloud admins group and members. The purpose of that group was granting super user powers for doing OpenStackManager actions. That is no longer needed/useful with MediaWiki-extensions-OpenStackManager reduced to functionally only adding steps to developer account creation (collecting shell name, altering generated LDAP records).

It sounds like the steps needed here are:

1. mwscript emptyUserGroup.php --wiki=labswiki --group shell
2. mwscript emptyUserGroup.php --wiki=labswiki --group cloudadmin
3. Patch to remove shell and cloudadmin definitions from operations/mediawiki-config.git
4. Patch to remove messages from WikimediaMessages

In T241027#5755150, @Quiddity wrote:

@DannyS712 Yes to everything else (as far as I understand it), but I suggest removing/rewriting the part of the description that says "... merging with local stewards ...", because there is still a hope/plan to make wikitech part of SUL someday (T161859 et al), in which case that merge would cause an additional & unnecessary complication.

In that case, maybe local crats? I don't think a separate group is needed...

In T241027#5755301, @bd808 wrote:

I think we can just remove the cloud admins group and members. The purpose of that group was granting super user powers for doing OpenStackManager actions. That is no longer needed/useful with MediaWiki-extensions-OpenStackManager reduced to functionally only adding steps to developer account creation (collecting shell name, altering generated LDAP records).

It sounds like the steps needed here are:

1. mwscript emptyUserGroup.php --wiki=labswiki --group shell
2. mwscript emptyUserGroup.php --wiki=labswiki --group cloudadmin
3. Patch to remove shell and cloudadmin definitions from operations/mediawiki-config.git
4. Patch to remove messages from WikimediaMessages

Would it be helpful to log the removal on-wiki? emptyUserGroup.php doesn't do that, but doing it client side would create logs. Since crats (who can remove shell users) have noratelimit, it should only take a minute to remove the group in a logged manner, which I think would be better. If someone wants to flag DannyS712 as a crat for a bit, I can take care of that and link here for the reason (and I promise not to do anything else with the rights). Via api, query users[1] and then map to action=userrights for removal.

[1] https://wikitech.wikimedia.org/w/api.php?action=query&list=allusers&augroup=shell&aulimit=max

I think the script way is better and efficient here. Wikitech is a special wiki nonetheless, and there's no point in removing 500+ users manually (cloudadmin and shell combined).