Page MenuHomePhabricator

k8s_infrastructure_users: rsyslog and echostore share the same id
Closed, ResolvedPublic

Description

In private repo, the users rsyslog and echostore share the same id.

I *guess* echostore currently wins as it comes last in the list and because it seems to be working, at least deployments do.

The docs say [1][2]:

UID: a string which identifies the end user and attempts to be more consistent and unique than username.

So maybe we could just drop the numeric ID from hiera and use the username as UID as well (as I think we aim for them to be unique anyways)?

When we decide to change that, we could also rename the "type" field to "group" to better reflect what it actually is.

The proposed patch adds to new "after-migration" tasks:

  • Remove the packages_from_future gate after migrating all clusters to kubernetes 1.16
  • Remove the groups gate after migrating all user stanzas from type to groups

[1] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#authentication-strategies
[2] https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file

Event Timeline

Change 647011 had a related patch set uploaded (by Alexandros Kosiaris; owner: Alexandros Kosiaris):
[operations/puppet@production] k8s_infrastructure_users: Amend to support groups, avoid uid conflicts

https://gerrit.wikimedia.org/r/647011

JMeybohm triaged this task as Medium priority.Jan 18 2021, 11:29 AM
JMeybohm updated the task description. (Show Details)

Change 647011 merged by JMeybohm:
[operations/puppet@production] k8s_infrastructure_users: Amend to support groups, avoid uid conflicts

https://gerrit.wikimedia.org/r/647011

Change 674585 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[labs/private@master] Migrate two k8s users to groups syntax

https://gerrit.wikimedia.org/r/674585

Change 674585 merged by JMeybohm:
[labs/private@master] Migrate two k8s users to groups syntax

https://gerrit.wikimedia.org/r/674585

Change 674607 had a related patch set uploaded (by JMeybohm; owner: JMeybohm):
[operations/puppet@production] k8s users: Remove special case for migration, use list of groups

https://gerrit.wikimedia.org/r/674607

Change 674607 merged by JMeybohm:

[operations/puppet@production] k8s users: Remove special case for migration, use list of groups

https://gerrit.wikimedia.org/r/674607

Change 677825 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[labs/private@master] Migrate kubernetes infrastructure_users to new syntax

https://gerrit.wikimedia.org/r/677825

Change 677825 merged by JMeybohm:

[labs/private@master] Migrate kubernetes infrastructure_users to new syntax

https://gerrit.wikimedia.org/r/677825

Change 677839 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/puppet@production] k8s_infrastructure_users: Remove special case for old schema

https://gerrit.wikimedia.org/r/677839

Change 677839 merged by JMeybohm:

[operations/puppet@production] k8s_infrastructure_users: Remove special case for old schema

https://gerrit.wikimedia.org/r/677839

Users and template migrated to use the username as user ID and a YAML list of groups instead of "type".

Change 677926 had a related patch set uploaded (by JMeybohm; author: JMeybohm):

[operations/puppet@production] infrastructure_users: Remove comments with old schema

https://gerrit.wikimedia.org/r/677926

Change 677926 merged by JMeybohm:

[operations/puppet@production] infrastructure_users: Remove comments with old schema

https://gerrit.wikimedia.org/r/677926