Page MenuHomePhabricator

Deprecate the anaytics-users POSIX group
Open, Needs TriagePublic8 Estimated Story Points

Description

The analytics-users posix group contains only 6 users, and it was meant to provide ssh access only to stat100x (no PII access). This use case seems not really needed anymore, people should be able to just use analytics-privatedata-users without kerberos.

analytics-users:
  gid: 7080
  description: Gives generic client access to the Analytics cluster
               via stat100x.
               If a user is added to this group it should not
               need to be in researchers or analytics-privatedata-users.
               In case of doubt, please ask to the Analytics team.
               More info https://wikitech.wikimedia.org/wiki/Analytics/Data_access#Access_Groups
  members: [debt, jdittrich, kharlan, brion, mhurd, santhosh]

Let's follow up with users to see if they need the access.

Related Objects

Event Timeline

elukey created this task.Dec 1 2020, 5:40 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 1 2020, 5:40 PM

Change 644576 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin: remove users already in 'researchers' from 'analytics-users'

https://gerrit.wikimedia.org/r/644576

Change 644576 merged by Elukey:
[operations/puppet@production] admin: remove users already in 'researchers' from 'analytics-users'

https://gerrit.wikimedia.org/r/644576

@brion @Mhurd @SantoshiWiki Hi! My team is trying to consolidate POSIX groups, and you are the last ones remaining in analytics-users. The group basically grants only ssh access to stat100x, without any PII access (wiki replicas, hadoop, etc..). Do you still need it? If so, I'd ask you to create an SRE Access Request for the analytics-privatedata-users stating your use case etc.. (I can help in the process, filing tasks etc..). If you don't need access I can remove it from puppet :)

Change 644592 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin: add comments to analytics posix groups

https://gerrit.wikimedia.org/r/644592

Change 644592 merged by Elukey:
[operations/puppet@production] admin: add comments to analytics posix groups

https://gerrit.wikimedia.org/r/644592

Ottomata moved this task from Backlog to Q2 2020/2021 on the Analytics-Clusters board.
Ottomata assigned this task to elukey.Dec 14 2020, 4:35 PM

@brion @Mhurd @SantoshiWiki Hi! My team is trying to consolidate POSIX groups, and you are the last ones remaining in analytics-users. The group basically grants only ssh access to stat100x, without any PII access (wiki replicas, hadoop, etc..). Do you still need it? If so, I'd ask you to create an SRE Access Request for the analytics-privatedata-users stating your use case etc.. (I can help in the process, filing tasks etc..). If you don't need access I can remove it from puppet :)

@brion @Mhurd @SantoshiWiki second ping :) If I don't hear anything from you by Monday 21st I'll remove your username from this old group. In case needed we'll add you to analytics-privatedata-users very quickly :)

Change 651448 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin: deprecate the analytics-users posix group

https://gerrit.wikimedia.org/r/651448

elukey moved this task from Next Up to In Progress on the Analytics-Kanban board.Dec 22 2020, 11:01 AM

Change 651448 merged by Elukey:
[operations/puppet@production] admin: deprecate the analytics-users posix group

https://gerrit.wikimedia.org/r/651448

Change 654271 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] Remove analytics-users from various analytics and sre configs

https://gerrit.wikimedia.org/r/654271

Change 654271 merged by Elukey:
[operations/puppet@production] Remove analytics-users from various analytics and sre configs

https://gerrit.wikimedia.org/r/654271

elukey moved this task from In Progress to Done on the Analytics-Kanban board.Thu, Jan 7, 4:35 PM
elukey set the point value for this task to 8.
elukey moved this task from Q3 2020/2021 to Done on the Analytics-Clusters board.