Page MenuHomePhabricator
Create Task
Maniphest T246059

Add admin account creation to maintain-kubeusers
Closed, ResolvedPublic
Actions

Description

Right now, cluster maintenance is as cluster-admin on the control plane. This should only be used when absolutely needed.

Add admin accounts for <project>.admin group members.

Details

ProjectBranchLines +/-Subject
labs/tools/maintain-kubeusersmaster+1 -1contexts: context should be correct for project
labs/tools/maintain-kubeusersmaster+24 -6admins: mount the NFS home dirs in the container
labs/tools/maintain-kubeusersmaster+12 -5admins: Another bugfix -- duplicate names of clusterrolebindings
labs/tools/maintain-kubeusersmaster+1 -1admins: Fixed critical typo
labs/tools/maintain-kubeusersmaster+1 K -334admins: Introduce admin user creation for projects
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedBstormT246059 Add admin account creation to maintain-kubeusers
 ResolvedBstormT214513 Deploy and migrate tools to a Kubernetes v1.15 or newer cluster
 ResolvedBstormT111914 Setup DNS for kubernetes services
 ResolvedaborreroT142862 Setup Kubernetes Masters in a HA setup
 ResolvedaborreroT215663 Stand up upgraded Toolforge etcd clusters
 ResolvedaborreroT215530 Sort out the best method of spinning up multiple toolforge kubernetes masters
 ResolvedaborreroT215679 Sort out and test deploying the worker nodes in a sane fashion
 ResolvedaborreroT215975 Package/copy kubeadm, kubelet, docker-ce and kubectl to Toolforge Aptly or Reprepro
 ResolvedJproramaT172855 Create visual diagram of documented components of Toolforge Kubernetes cluster
 ResolvedaborreroT215531 Deploy upgraded Kubernetes to toolsbeta
 ResolvedBstormT215529 Puppetize/stand up a load balancer for K8s API servers
 ResolvedaborreroT226098 Toolforge: modernize deployment for etcd in k8s
 ResolvedaborreroT228267 Toolforge: iptables flavor for Debian Buster-based k8s cluster
 ResolvedaborreroT228500 Toolforge: evaluate ingress mechanism
 ResolvedaborreroT234032 Toolforge ingress: create a default landing page for unknown/default URLs
 ResolvedaborreroT234037 Toolforge ingress: decide on final layout of north-south proxy setup
 ResolvedaborreroT235059 Toolforge: refresh puppet code for proxy (dynamicproxy) to support Debian Buster
 ResolvedBstormT234231 Toolforge ingress: decide on how ingress configuration objects will be managed
 ResolveddduvallT236203 Add CI checks for golang admission controllers
 ResolvedBstormT254293 Change to admission controller readme.md failed to pass gate-and-submit jobs
 ResolvedaborreroT228660 Toolforge: new k8s: issues with the initial coredns setup
 ResolvedBstormT228887 Update pause container in our internal registry
 ResolvedBstormT229009 Proposal: ditching the master name in kubernetes servers
 ResolvedBstormT234702 Review and establish configurable quotas for users in the new Kubernetes cluster
 ResolvedaborreroT236074 Toolforge: rebuild the new k8s toolsbeta deployment and write final docs
 ResolvedaborreroT236249 Toolforge: new k8s: upload internal docker images to our registry
 ResolvedaborreroT236824 Toolforge: new k8s: get new deb packages for 1.15.4 or 1.15.5
 ResolvedaborreroT237443 toolsbeta: new k8s: deploy a front proxy (dynamicproxy)
 ResolvedBstormT237541 CoreDNS in the new k8s cluster cannot talk to the Cloud recursors
 DeclinedNoneT238641 toolforge: some additional testing before final migration
 ResolvedaborreroT239403 toolforge: new k8s: scale up a bit the cluster before final tests and initial migrations
 OpenNoneT239404 toolforge: new k8s: evaluate DNS (coredns) autoscale options
 ResolvedaborreroT239405 toolforge: new k8s: evaluate ingress controller reload behaviour
 StalledNoneT239406 toolforge: new k8s: evalute and test firewalling via calico
 ResolvedaborreroT238655 toolforge: new k8s: issues with the apiserver and etcd
 ResolvedBstormT215553 Figure out cert management for Toolforge kubernetes and make it clear in documents, etc. for the upgrade
 ResolvedBstormT169287 etcd config depends on puppet certs, but puppet doesn't know
 ResolvedyuvipandaT119814 Figure out how to deal with SSL cert issues for kubernetes masters
 DuplicateNoneT144153 Move kubernetes authentication to using X.509 client certs
 ResolvedBstormT215678 Replace each of the custom controllers with something in a new Toolforge Kubernetes setup
 ResolvedBstormT227290 Design and document how to integrate the new Toolforge k8s cluster with PodSecurityPolicy
 ResolvedBstormT238162 Establish a process for renewing TLS certs for the 2 webhook controllers
 DuplicateNoneT224273 Toolforge: develop new k8s cluster in toolsbeta
 ResolvedBstormT233372 Create a "novaobserver" equivalent for Toolforge Kubernetes cluster inspection
 ResolvedaborreroT235627 Toolforge: upgrade main proxy servers to Debian Buster
 DuplicateNoneT235756 Toolforge: webservice utility: add support for thew new k8s setup
 ResolvedBstormT236202 Modify webservice and maintain-kubeusers to allow switching to the new cluster
 ResolvedBstormT228499 Toolforge: changes to maintain-kubeusers
 ResolvedBstormT229058 Replace the nslcd mount in containers from the old Toolforge cluster with something that will work with sssd in the new one
 ResolvedBstormT237836 `webservice restart` regression with backend=kubernetes in webservice 0.51
 ResolvedaborreroT236826 Toolforge: new k8s: initial build of the new kubernetes cluster
 ResolvedaborreroT237633 Request increased quota for tools Cloud VPS project
 ResolvedaborreroT237643 toolforge: new k8s: figure out metrics / observability
 ResolvedaborreroT237557 new proxy and etcd nodes unreachable by ssh for tools-prometheus
 ResolvedaborreroT238058 toolforge: prometheus-node-exporter not working on tools-proxy-06
 ResolvedaborreroT238096 Toolforge: prometheus: refresh setup
 ResolvedaborreroT245180 Document and test failing over prometheus
 ResolvedaborreroT240402 Deploy or consciously decide not to deploy metrics-server in toolforge kubernetes
 ResolvedaborreroT241853 Move metrics-server and kube-state-metrics into the new metrics namespace
 ResolvedBstormT237784 Document migration plans and timelines
 ResolvedBstormT237789 Document (and execute) the upgrade process for the new Toolforge K8s cluster
 ResolvedBstormT238654 toolforge: new k8s: issues with routing interfering with DNS in the cluster as well as the webhook controllers
 DuplicateNoneT239407 toolforge: new k8s: package newer/more convenient python3 k8s client libs
 ResolvedaborreroT239409 toolforge: new k8s: introduce more robust controls for deb pkg versions
Restricted Task
 OpenNoneT272905 Reduce privs of metrics pods where we can
 ResolvedBstormT240922 Change name of commons_describer tool or provide some workaround for Kubernetes/DNS
 Resolved• bd808T240923 Fix toolschecker's insistence that a kubeconfig is json
 InvalidaborreroT240925 `kubectl get pods` fails after switching to new k8s cluster
 Resolved• bd808T241008 New k8s cluster routing behaving strangely for bd808-test tool
 Resolved• bd808T241310 Kubernetes ingress passes it's port & proto to apps rather than the port & proto from the front proxy
Restricted Task
 ResolvedSecurityBstormT242067 Error joining new worker node to Toolforge Kubernetes cluster
 ResolvedaborreroT242719 https://tools.wmflabs.org/{toolname} no longer redirects to https://tools.wmflabs.org/{toolname}/ on new k8s cluster
 Resolved• bd808T242824 Tool account cannot list all namespaced objects in its Kubernetes namespace
 DuplicateNoneT243468 Add smarter resourcing logic to kubernetes backend of webservice
 ResolvedBstormT244289 Improve limit range management in webservice for Kubernetes
 Resolved• bd808T244293 Add a function to webservice called "migrate" that will push a tool from the old cluster on Kubernetes to the new one
 Resolved• bd808T244791 Scale up 2020 Kubernetes cluster for final migration of legacy cluster workloads

Event Timeline

Bstorm triaged this task as Medium priority.Feb 25 2020, 2:04 AM
Bstorm created this task.
Krenair added a subscriber: Krenair.Feb 28 2020, 10:37 PM
• bd808 removed a parent task: T214513: Deploy and migrate tools to a Kubernetes v1.15 or newer cluster.Mar 2 2020, 6:04 PM
• bd808 added a subtask: T214513: Deploy and migrate tools to a Kubernetes v1.15 or newer cluster.
• bd808 closed subtask T214513: Deploy and migrate tools to a Kubernetes v1.15 or newer cluster as Resolved.Apr 11 2020, 8:47 PM
gerritbot added a comment.Apr 17 2020, 12:52 AM

Change 589454 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: Introduce admin user creation for projects

https://gerrit.wikimedia.org/r/589454

gerritbot added a project: Patch-For-Review.Apr 17 2020, 12:52 AM
Bstorm mentioned this in T211096: PAWS: Rebuild and upgrade Kubernetes.Apr 28 2020, 4:26 PM
gerritbot added a comment.May 15 2020, 8:27 PM

Change 589454 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: Introduce admin user creation for projects

https://gerrit.wikimedia.org/r/589454

Stashbot added a comment.May 15 2020, 8:48 PM

Mentioned in SAL (#wikimedia-cloud) [2020-05-15T20:48:33Z] <bstorm_> found an error in the new version of maintain-kubeusers, removing the deployment for now T246059

Maintenance_bot removed a project: Patch-For-Review.May 15 2020, 9:10 PM
gerritbot added a comment.May 15 2020, 9:30 PM

Change 596763 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: Fixed critical typo

https://gerrit.wikimedia.org/r/596763

gerritbot added a project: Patch-For-Review.May 15 2020, 9:30 PM
gerritbot added a comment.May 15 2020, 9:42 PM

Change 596763 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: Fixed critical typo

https://gerrit.wikimedia.org/r/596763

gerritbot added a comment.May 15 2020, 10:03 PM

Change 596770 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: Another bugfix -- duplicate names of clusterrolebindings

https://gerrit.wikimedia.org/r/596770

gerritbot added a comment.May 15 2020, 10:09 PM

Change 596770 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: Another bugfix -- duplicate names of clusterrolebindings

https://gerrit.wikimedia.org/r/596770

Maintenance_bot removed a project: Patch-For-Review.May 15 2020, 10:11 PM
gerritbot added a comment.May 15 2020, 10:50 PM

Change 596781 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: mount the NFS home dirs in the container

https://gerrit.wikimedia.org/r/596781

gerritbot added a project: Patch-For-Review.May 15 2020, 10:50 PM
gerritbot added a comment.May 15 2020, 11:24 PM

Change 596781 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: mount the NFS home dirs in the container

https://gerrit.wikimedia.org/r/596781

Bstorm added a comment.May 15 2020, 11:27 PM

Ok, after much fussing, this provides view access by default and using impersonation allows assuming other privs even cluster-admin. Therefore, it is effectively similar to sudo access in the cluster.

Bstorm added a comment.May 15 2020, 11:51 PM

Added documentation here https://wikitech.wikimedia.org/wiki/Portal:Toolforge/Admin/Kubernetes#Admin_accounts

Maintenance_bot removed a project: Patch-For-Review.May 16 2020, 12:11 AM
Stashbot added a comment.May 26 2020, 6:45 PM

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T18:45:36Z] <bstorm_> upgrading maintain-kubeusers to match what is in toolsbeta T246059 T211096

gerritbot added a comment.May 26 2020, 9:54 PM

Change 598863 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] contexts: context should be correct for project

https://gerrit.wikimedia.org/r/598863

gerritbot added a project: Patch-For-Review.May 26 2020, 9:54 PM
Stashbot added a comment.May 26 2020, 10:03 PM

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T22:03:53Z] <bstorm_> created paws.admin group and kubernetes admin accounts on the new k8s cluster T211096 T246059

Stashbot added a comment.May 26 2020, 10:05 PM

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T22:05:51Z] <bstorm_> temporarily deleted the deployment for maintain-kubeusers pending patch to fix context creation for new admin accounts T211096 T246059

gerritbot added a comment.May 26 2020, 10:18 PM

Change 598863 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] contexts: context should be correct for project

https://gerrit.wikimedia.org/r/598863

Stashbot added a comment.May 26 2020, 10:34 PM

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T22:34:39Z] <bstorm_> restored the deployment for maintain-kubeusers so anyone added to the paws.admin group will have admin on the cluster now that the bug is fixed T211096 T246059

Maintenance_bot removed a project: Patch-For-Review.May 26 2020, 11:10 PM
Bstorm closed this task as Resolved.Jun 11 2020, 11:23 PM
Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL