Account checker has been reporting that
Malformed membership for ops user <user>, has additional group(s): {'contint-admins', 'contint-docker'}
It might be related to https://gerrit.wikimedia.org/r/c/operations/puppet/+/666941 or https://gerrit.wikimedia.org/r/c/operations/puppet/+/666940