Page MenuHomePhabricator

Add admin account creation to maintain-kubeusers
Closed, ResolvedPublic

Description

Right now, cluster maintenance is as cluster-admin on the control plane. This should only be used when absolutely needed.

Add admin accounts for <project>.admin group members.

Related Objects

StatusSubtypeAssignedTask
ResolvedBstorm
ResolvedBstorm
ResolvedBstorm
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
ResolvedJprorama
Resolvedaborrero
ResolvedBstorm
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
ResolvedBstorm
Resolveddduvall
ResolvedBstorm
Resolvedaborrero
ResolvedBstorm
ResolvedBstorm
ResolvedBstorm
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
ResolvedBstorm
DeclinedNone
Resolvedaborrero
OpenNone
Resolvedaborrero
StalledNone
Resolvedaborrero
ResolvedBstorm
ResolvedBstorm
Resolvedyuvipanda
DuplicateNone
ResolvedBstorm
ResolvedBstorm
ResolvedBstorm
DuplicateNone
ResolvedBstorm
Resolvedaborrero
DuplicateNone
ResolvedBstorm
ResolvedBstorm
ResolvedBstorm
ResolvedBstorm
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
Resolvedaborrero
ResolvedBstorm
ResolvedBstorm
ResolvedBstorm
DuplicateNone
Resolvedaborrero
OpenNone
ResolvedBstorm
Resolved bd808
Invalidaborrero
Resolved bd808
Resolved bd808
ResolvedSecurityBstorm
Resolvedaborrero
Resolved bd808
DuplicateNone
ResolvedBstorm
Resolved bd808
Resolved bd808

Event Timeline

Bstorm triaged this task as Medium priority.Feb 25 2020, 2:04 AM
Bstorm created this task.

Change 589454 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: Introduce admin user creation for projects

https://gerrit.wikimedia.org/r/589454

Change 589454 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: Introduce admin user creation for projects

https://gerrit.wikimedia.org/r/589454

Mentioned in SAL (#wikimedia-cloud) [2020-05-15T20:48:33Z] <bstorm_> found an error in the new version of maintain-kubeusers, removing the deployment for now T246059

Change 596763 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: Fixed critical typo

https://gerrit.wikimedia.org/r/596763

Change 596763 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: Fixed critical typo

https://gerrit.wikimedia.org/r/596763

Change 596770 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: Another bugfix -- duplicate names of clusterrolebindings

https://gerrit.wikimedia.org/r/596770

Change 596770 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: Another bugfix -- duplicate names of clusterrolebindings

https://gerrit.wikimedia.org/r/596770

Change 596781 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] admins: mount the NFS home dirs in the container

https://gerrit.wikimedia.org/r/596781

Change 596781 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] admins: mount the NFS home dirs in the container

https://gerrit.wikimedia.org/r/596781

Ok, after much fussing, this provides view access by default and using impersonation allows assuming other privs even cluster-admin. Therefore, it is effectively similar to sudo access in the cluster.

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T18:45:36Z] <bstorm_> upgrading maintain-kubeusers to match what is in toolsbeta T246059 T211096

Change 598863 had a related patch set uploaded (by Bstorm; owner: Bstorm):
[labs/tools/maintain-kubeusers@master] contexts: context should be correct for project

https://gerrit.wikimedia.org/r/598863

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T22:03:53Z] <bstorm_> created paws.admin group and kubernetes admin accounts on the new k8s cluster T211096 T246059

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T22:05:51Z] <bstorm_> temporarily deleted the deployment for maintain-kubeusers pending patch to fix context creation for new admin accounts T211096 T246059

Change 598863 merged by jenkins-bot:
[labs/tools/maintain-kubeusers@master] contexts: context should be correct for project

https://gerrit.wikimedia.org/r/598863

Mentioned in SAL (#wikimedia-cloud) [2020-05-26T22:34:39Z] <bstorm_> restored the deployment for maintain-kubeusers so anyone added to the paws.admin group will have admin on the cluster now that the bug is fixed T211096 T246059