Page MenuHomePhabricator

puppet admin module: Assign approvers to unix groups
Open, MediumPublic

Description

When adding users to unix group we try to have an engineering manager responsible for the general area of operations approve the access request. This is something that has happened in a somewhat add hoc way in the past however it would be useful going forward to assign engineering managers to all groups in the admin data.yaml file. This makes it easier for SRE engineers who are managing the clinic duty fine the correct list of approvers.

With this in mind i have generated a list of all the group which currently have no approvers and the roles that theses group give access to. I have tried to go through the list manually and assign managers which seem appropriate to me, however i have likely got some of theses wrong so please let me know where i have need to make corrections. Further there are still a bunch of group which are left blank so if people could either claim theses groups or suggest owners that would be very much appreciated.

Task description has been updated to list the remaining groups without a approval contact (except groups marked as deprecated):

  • airflow-search-admins
  • analytics-research-admins (removed)
  • analytics-search-users
  • analytics-wmde-users
  • cassandra-test-roots
  • contint-docker
  • dataset-admins
  • deploy-aqs
  • deploy-design
  • deploy-service
  • deployment-docker
  • deployment-jenkins
  • dns-admins
  • druid-admins
  • htmldumps-admin
  • ldap-admins
  • logstash-roots
  • mailman3-roots
  • maintenance-log-readers
  • mediawiki-testers
  • mw-log-readers
  • pentesters
  • perf-roots
  • perf-team
  • releasers-blubber
  • releasers-mediawiki
  • releasers-mobile
  • releasers-mwcli
  • releasers-wikidiff2
  • restbase-admins
  • restbase-roots
  • sessionstore-roots
  • traceback-roots (removed)
  • udp2log-users
  • varnish-log-readers
  • wmcs-admin

Event Timeline

jbond triaged this task as Medium priority.Mar 4 2021, 3:03 PM
jbond created this task.

Thanks for generating an overview, I'm taking care of these piece by piece (but at slow rate)

Legoktm renamed this task from puppet admin module: Assigne approveres to unix groups to puppet admin module: Assign approvers to unix groups.Mar 8 2021, 6:24 PM

Change 671178 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add approval for snapshot admins

https://gerrit.wikimedia.org/r/671178

Change 671180 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add approcal for swift-roots

https://gerrit.wikimedia.org/r/671180

Change 671182 had a related patch set uploaded (by Muehlenhoff; owner: Muehlenhoff):
[operations/puppet@production] Add approval for graphite-admins

https://gerrit.wikimedia.org/r/671182

Change 671180 merged by Muehlenhoff:
[operations/puppet@production] Add approval for swift-roots

https://gerrit.wikimedia.org/r/671180

Change 671178 merged by Muehlenhoff:
[operations/puppet@production] Add approval for snapshot admins

https://gerrit.wikimedia.org/r/671178

Change 671182 merged by Muehlenhoff:
[operations/puppet@production] Add approval for graphite-admins

https://gerrit.wikimedia.org/r/671182

Change 960546 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Mark mediawiki-testers as deprecated

https://gerrit.wikimedia.org/r/960546

Change 960547 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Mark pentesters as deprecated

https://gerrit.wikimedia.org/r/960547

Change 960548 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Remove traceback-roots

https://gerrit.wikimedia.org/r/960548

Change 960548 merged by Muehlenhoff:

[operations/puppet@production] Remove traceback-roots

https://gerrit.wikimedia.org/r/960548

Change 960547 abandoned by Muehlenhoff:

[operations/puppet@production] Mark pentesters as deprecated

Reason:

Can instead be removed, created a new patch

https://gerrit.wikimedia.org/r/960547

Change 960546 merged by Muehlenhoff:

[operations/puppet@production] Mark mediawiki-testers as deprecated

https://gerrit.wikimedia.org/r/960546

Change 967899 had a related patch set uploaded (by Muehlenhoff; author: Muehlenhoff):

[operations/puppet@production] Add Tyler for approval of various release groups

https://gerrit.wikimedia.org/r/967899

Change 967899 merged by Muehlenhoff:

[operations/puppet@production] Add Tyler for approval of various release groups

https://gerrit.wikimedia.org/r/967899

@MoritzMuehlenhoff: Per emails from Sep18 and Oct20 and https://www.mediawiki.org/wiki/Bug_management/Assignee_cleanup , I am resetting the assignee of this task because there has not been progress lately (please correct me if I am wrong!). Resetting the assignee avoids the impression that somebody is already working on this task. It also allows others to potentially work towards fixing this task. Please claim this task again when you plan to work on it (via Add Action...Assign / Claim in the dropdown menu) - it would be welcome. Thanks for your understanding!

There is progress, the last change only happened on October 26. This is a long standing task with low priority which is being worked on when time allows, as such I'm reassigning it myself again.