Page MenuHomePhabricator

Requesting exec access to pods in 'ci' namespace staging kubernetes
Open, Stalled, MediumPublic

Description

To increase the velocity of developing and testing T288629 I am requesting exec access to pods in the 'ci' namespace on the staging kubernetes cluster, at least temporarily.

Thank you and have a nice day.

Event Timeline

akosiaris triaged this task as Medium priority.Sep 8 2021, 2:56 PM
akosiaris subscribed.

Hi @dancy

As in personal level access? We don't have user level accounts, so it would be something new. Or for automated testing, meaning adding the right to some account that is already used?

On another note, I must say that execing into one of our images is quite possibly going to prove an exercise in frustration regarding tooling. You will find basic tools you are accustomed to (e.g. ps and family, netstat, lsof, editors, all the networking ones like ping, traceroute, dig, host etc ) are just not there.

Hi @dancy

As in personal level access? We don't have user level accounts, so it would be something new.

Yes. Or, alternatively, access to an existing account/group with more privileges.

Or for automated testing, meaning adding the right to some account that is already used?

This is for interactive development of what will eventually be an automated testing system.

On another note, I must say that execing into one of our images is quite possibly going to prove an exercise in frustration regarding tooling. You will find basic tools you are accustomed to (e.g. ps and family, netstat, lsof, editors, all the networking ones like ping, traceroute, dig, host etc ) are just not there.

I made a new image based on the mediawiki-multiversion image which has the necessary debug tools installed.

Change 722869 had a related patch set uploaded (by Alexandros Kosiaris; author: Alexandros Kosiaris):

[operations/deployment-charts@master] Experiment with a jenkins-debug user

https://gerrit.wikimedia.org/r/722869

herron changed the task status from Open to Stalled.Nov 30 2021, 4:09 PM
herron removed a project: SRE-Access-Requests.
herron subscribed.

This doesn't appear to be immediately actionable in terms of SRE clinic duty workflow. I'm going to remove the SRE-Access-Requests tag while the best approach is being discussed and designed. Please re-add the tag when ready to proceed with a request for specific group membership(s), or if you disagree. Thanks!