Page MenuHomePhabricator
Create Task
Maniphest T269150

Deprecate the anaytics-users POSIX group
Closed, ResolvedPublic8 Estimated Story Points
Actions

Description

The analytics-users posix group contains only 6 users, and it was meant to provide ssh access only to stat100x (no PII access). This use case seems not really needed anymore, people should be able to just use analytics-privatedata-users without kerberos.

analytics-users:
  gid: 7080
  description: Gives generic client access to the Analytics cluster
               via stat100x.
               If a user is added to this group it should not
               need to be in researchers or analytics-privatedata-users.
               In case of doubt, please ask to the Analytics team.
               More info https://wikitech.wikimedia.org/wiki/Analytics/Data_access#Access_Groups
  members: [debt, jdittrich, kharlan, brion, mhurd, santhosh]

Let's follow up with users to see if they need the access.

Details

SubjectRepoBranchLines +/-
Remove analytics-users from various analytics and sre configsoperations/puppetproduction+4 -11
admin: deprecate the analytics-users posix groupoperations/puppetproduction+12 -15
admin: add comments to analytics posix groupsoperations/puppetproduction+6 -5
admin: remove users already in 'researchers' from 'analytics-users'operations/puppetproduction+1 -1
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
 ResolvedodimitrijevicT240437 Analytics Ops Technical Debt
 ResolvedelukeyT269150 Deprecate the anaytics-users POSIX group

Event Timeline

elukey created this task.Dec 1 2020, 5:40 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 1 2020, 5:40 PM
gerritbot added a comment.Dec 1 2020, 6:10 PM

Change 644576 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin: remove users already in 'researchers' from 'analytics-users'

https://gerrit.wikimedia.org/r/644576

gerritbot added a project: Patch-For-Review.Dec 1 2020, 6:10 PM
gerritbot added a comment.Dec 1 2020, 6:14 PM

Change 644576 merged by Elukey:
[operations/puppet@production] admin: remove users already in 'researchers' from 'analytics-users'

https://gerrit.wikimedia.org/r/644576

elukey added subscribers: SantoshiWiki, Mhurd, • brooke.Dec 1 2020, 6:24 PM

@brion @Mhurd @SantoshiWiki Hi! My team is trying to consolidate POSIX groups, and you are the last ones remaining in analytics-users. The group basically grants only ssh access to stat100x, without any PII access (wiki replicas, hadoop, etc..). Do you still need it? If so, I'd ask you to create an SRE Access Request for the analytics-privatedata-users stating your use case etc.. (I can help in the process, filing tasks etc..). If you don't need access I can remove it from puppet :)

gerritbot added a comment.Dec 1 2020, 6:44 PM

Change 644592 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin: add comments to analytics posix groups

https://gerrit.wikimedia.org/r/644592

gerritbot added a comment.Dec 1 2020, 6:45 PM

Change 644592 merged by Elukey:
[operations/puppet@production] admin: add comments to analytics posix groups

https://gerrit.wikimedia.org/r/644592

Maintenance_bot removed a project: Patch-For-Review.Dec 1 2020, 7:10 PM
elukey added a parent task: T240437: Analytics Ops Technical Debt.Dec 2 2020, 8:18 AM
Ottomata edited projects, added Analytics-Clusters; removed Analytics.Dec 7 2020, 4:28 PM
Ottomata moved this task from Backlog to Q1 2021/2022 on the Analytics-Clusters board.
Ottomata assigned this task to elukey.Dec 14 2020, 4:35 PM
Ottomata moved this task from Q1 2021/2022 to Q3 2020/2021 on the Analytics-Clusters board.Dec 14 2020, 4:38 PM
Ottomata added a project: Analytics-Kanban.
elukey added a comment.Dec 16 2020, 10:48 AM
In T269150#6660663, @elukey wrote:

@brion @Mhurd @SantoshiWiki Hi! My team is trying to consolidate POSIX groups, and you are the last ones remaining in analytics-users. The group basically grants only ssh access to stat100x, without any PII access (wiki replicas, hadoop, etc..). Do you still need it? If so, I'd ask you to create an SRE Access Request for the analytics-privatedata-users stating your use case etc.. (I can help in the process, filing tasks etc..). If you don't need access I can remove it from puppet :)

@brion @Mhurd @SantoshiWiki second ping :) If I don't hear anything from you by Monday 21st I'll remove your username from this old group. In case needed we'll add you to analytics-privatedata-users very quickly :)

gerritbot added a comment.Dec 22 2020, 8:48 AM

Change 651448 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] admin: deprecate the analytics-users posix group

https://gerrit.wikimedia.org/r/651448

gerritbot added a project: Patch-For-Review.Dec 22 2020, 8:48 AM
elukey moved this task from Next Up to In Progress on the Analytics-Kanban board.Dec 22 2020, 11:01 AM
gerritbot added a comment.Jan 4 2021, 2:25 PM

Change 651448 merged by Elukey:
[operations/puppet@production] admin: deprecate the analytics-users posix group

https://gerrit.wikimedia.org/r/651448

Maintenance_bot removed a project: Patch-For-Review.Jan 4 2021, 3:10 PM
gerritbot added a comment.Jan 4 2021, 4:21 PM

Change 654271 had a related patch set uploaded (by Elukey; owner: Elukey):
[operations/puppet@production] Remove analytics-users from various analytics and sre configs

https://gerrit.wikimedia.org/r/654271

gerritbot added a project: Patch-For-Review.Jan 4 2021, 4:21 PM
gerritbot added a comment.Jan 7 2021, 3:45 PM

Change 654271 merged by Elukey:
[operations/puppet@production] Remove analytics-users from various analytics and sre configs

https://gerrit.wikimedia.org/r/654271

Maintenance_bot removed a project: Patch-For-Review.Jan 7 2021, 4:10 PM
elukey moved this task from In Progress to Done on the Analytics-Kanban board.Jan 7 2021, 4:35 PM
elukey set the point value for this task to 8.
elukey moved this task from Q3 2020/2021 to Done on the Analytics-Clusters board.
• fdans closed this task as Resolved.Jan 25 2021, 7:00 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits