Change 628196 had a related patch set uploaded (by Nskaggs; owner: Nskaggs):
[operations/puppet@production] icinga: Let Nskaggs issues commands on all hosts and services

https://gerrit.wikimedia.org/r/628196

I see you already put this on the agenda for the next SRE meeting on Monday, thanks. :) I expect it'll be uncontroversial, but if you don't need it urgently, we'll bring it up at the meeting and get it merged that afternoon.

This is usually done without separate access request for all users who have root shell. The difference here would just be "prod root" vs. "wmcs / cloud root".

In theory this is not needed because Icinga users should be able to run commands on all services they are contacts for anyways. So if the user is in a contact group and that contact group is used for the Icinga checks then they should have all those privileges already. Since previous work on contactgroups and wmcs-related alerts this might already just work.

The change in the cgi.cfg is just a global override that allows them _beyond_ that; it does not consider contactgroups.

That being said, i still think this is uncontroversial and we can just merge in on Monday. Because if we don't there are likely going to be some special cases and this is just the easier path forward.

Change 628196 merged by Dzahn:
[operations/puppet@production] icinga: Let Nskaggs issues commands on all hosts and services

https://gerrit.wikimedia.org/r/628196

I see the patch is already merged, @nskaggs please test icinga command and followup so we can close ticket. Thanks!