Deployers unable to ssh to parse* hosts
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Krinkle
	Sep 1 2021, 11:18 AM

Description

Deployers can ssh to all mw hosts (appservers, api-appservers, maintenance, jobrunners, etc.) to e.g. run scap pull or another one of a narrow set of commands during investigations.

But, they can't ssh to any of the parse* hosts because they don't seem to inherit or or otherwise have set the standard set of appserver-ish admin_groups.

I don't know if there are plans for, or decisions made against, having parsoid be a role within the mediawiki:: hierarchy. But in the interim perhaps it would make sense to add these two groups (deployers and perf-roots) to the parsoid role.

https://wikitech.wikimedia.org/wiki/Incident_documentation/2021-09-01_partial_parsoid_outage

Details

	Subject	Repo	Branch	Lines +/-
	add deployment and perf-roots shell groups to parsoid hosts	operations/puppet	production	+2 -0

Customize query in gerrit

Event Timeline

Krinkle created this task.Sep 1 2021, 11:18 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 1 2021, 11:18 AM

Krinkle moved this task from Limbo to Watching on the Performance-Team (Radar) board.Sep 1 2021, 11:18 AM

Urbanecm subscribed.Sep 1 2021, 11:20 AM

I support this. After all, any deployer already has sufficient access to SSH in via the mwdeploy system user (https://wikitech.wikimedia.org/wiki/Keyholder describes how that can be done). As such, adding deployers to the admin groups will not increase deployer's actual permission set.

Adding perf-roots would grant them root at those hosts (something that cannot be done through the method described above), but I think that's also fine.

Krinkle updated the task description. (Show Details)Sep 1 2021, 11:23 AM

Maintenance_bot added a project: SRE.Sep 1 2021, 11:45 AM

RhinosF1 subscribed.Sep 1 2021, 12:23 PM

Krinkle edited projects, added Sustainability (Incident Followup); removed Performance-Team (Radar), Release-Engineering-Team.Sep 1 2021, 12:45 PM

Krinkle updated the task description. (Show Details)Sep 1 2021, 12:53 PM

+1 to granting permissions like normal appservers, this seems like an oversight once Parsoid moved to PHP and is now part of MediaWiki proper rather than a separate service.

jijiki added subscribers: jbond, Muehlenhoff.Sep 1 2021, 3:11 PM

jijiki subscribed.

jijiki added a project: Infrastructure-Foundations.Sep 1 2021, 3:21 PM

What Lego said, access should mimick what we do with regular appservers.

Change 715988 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] add deploment and perf-roots shell groups to parsoid hosts

https://gerrit.wikimedia.org/r/715988

gerritbot added a project: Patch-For-Review.Sep 1 2021, 4:10 PM

fgiunchedi triaged this task as Medium priority.Sep 2 2021, 6:41 AM

Change 715988 merged by Dzahn:

[operations/puppet@production] add deployment and perf-roots shell groups to parsoid hosts

https://gerrit.wikimedia.org/r/715988