Page MenuHomePhabricator

Requesting access to analytics-privatedata-users for drochford (superset access with no server access)
Closed, ResolvedPublicRequest

Description

Requestor provided information and prerequisites

This section is to be completed by the individual requesting access.

I used to be able to see the Anti Harassment Dashboard, but now I get this error: ermission denied: user=drochford, access=EXECUTE, inode="/user/hive/warehouse":hive:analytics-privatedata-users:drwxrwx

  • Wikitech username: drochford
  • Email address: drochford@wikimedia.org
  • SSH public key (must be a separate key from Wikimedia cloud SSH access): I don't have an SSH key, I just need access to Superset so I can view dashboards.
  • Requested group membership: analytics-privatedata-users
  • Reason for access: I own the Anti Harassment Program and several dhasboards contribute to my program.
  • Name of approving party (manager for WMF/WMDE staff): Jan Eissfeldt (Not on Phabricator)
  • Ensure you have signed the L3 Wikimedia Server Access Responsibilities document: I have.
  • Please coordinate obtaining a comment of approval on this task from the approving party. jeissfeldt

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

  • - User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • - User has a valid NDA on file with WMF legal. (All WMF Staff/Contractor hiring are covered by NDA. Other users can be validated via the NDA tracking sheet)
  • - User has provided the following: wikitech username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
  • - User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not shared with any other service (this includes not sharing with WMCS access, no shared keys.)
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponsor for volunteers, manager for wmf staff)
  • - access request (or expansion) has sign off of group approver indicated by the approval field in data.yaml

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Event Timeline

@drochford: approving party will be whoever your manager is

analytics-privatedata-users will need @Ottomata or @odimitrijevic's approval too.

Thanks @RhinosF1 - My manager is Jan Eissfeldt, but Jan does hot use Phabricator. I've updated the task above.

Thanks @RhinosF1 - My manager is Jan Eissfeldt, but Jan does hot use Phabricator. I've updated the task above.

Their phab account is @JanWMF

approved, I asked David to when it turned out neither John Bennett nor I had access and I need a presentation based on a dashboard stored there :)

@JanWMF: Is there a deadline this needs to be done by then?

Thanks @RhinosF1; timely but no ironclad hard deadline, so we can certainly go proper process here :)

jcrespo renamed this task from Requesting access to analytics-privatedata-users for drochford to Requesting access to analytics-privatedata-users for drochford (superset access with no server access).Apr 11 2022, 12:33 PM
jcrespo updated the task description. (Show Details)

Hey, @drochford,

While I check and process your access request, would you mind linking your Wikitech/LDAP account on your Phabricator profile, like I have on mine, for example? As of this writing, you have linked your MediaWiki profile ( https://phabricator.wikimedia.org/p/drochford/ ), but the Wikitech/LDAP account is separate, and while not strictly needed, linking it on Phabricator will help us process later requests faster. It can be done on User setting > External Accounts > LDAP: https://phabricator.wikimedia.org/settings/user/drochford/page/external/

For example, your uid is indeed drochford, but your LDAP cn is DRochford, with uppercase- having it on Phabricator makes us locating it easier 0:-)

Change 779024 had a related patch set uploaded (by Jcrespo; author: Jcrespo):

[operations/puppet@production] admin: Add drochford to analytics-privatedata-users for superset

https://gerrit.wikimedia.org/r/779024

jcrespo added a subscriber: jcrespo.

This is only blocked on Data Engineering, as owners of the service, to approve the access. As documented, it should be done by either @Ottomata or @odimitrijevic.

jcrespo triaged this task as High priority.Apr 11 2022, 1:09 PM

Hey, @drochford,

While I check and process your access request, would you mind linking your Wikitech/LDAP account on your Phabricator profile, like I have on mine, for example?

Sure thing @jcrespo - I think I've successfully linked the two. Thanks for taking care of this for me!

Thank you a lot, drochford. Anything that helps us process request faster is much appreciated.

Change 779024 merged by Jcrespo:

[operations/puppet@production] admin: Add drochford to analytics-privatedata-users for superset

https://gerrit.wikimedia.org/r/779024

Access has been deployed, @drochford can you test access?

Boldly resolving, though @drochford please let us know and reopen is something is amiss!