Page MenuHomePhabricator

Add GRANT access to cloudcontrol1005 for labsadmin to wikireplicas
Closed, ResolvedPublic

Description

We are moving the script that creates the new r/o users on the wikireplicas (for toolforge + paws), and we have to duplicate all the grants on (we can clean up the old ones once the migration is finished).

The new machines (more than one for high availability) are:

  • cloudcontrol1005.wikimedia.org (208.80.154.85)
  • cloudcontrol1006.wikimedia.org (208.80.154.149)
  • cloudcontrol1007.wikimedia.org (208.80.155.104)

The current grants are:

mysql:labsdbadmin@clouddb1020.eqiad.wmnet [(none)]> show grants;
+-----------------------------------------------------------------------------------------------------------------------------------------------------+
| Grants for labsdbadmin@10.64.37.19                                                                                                                  |
+-----------------------------------------------------------------------------------------------------------------------------------------------------+
| GRANT `labsdbuser` TO `labsdbadmin`@`10.64.37.19` WITH ADMIN OPTION                                                                                 |
| GRANT SUPER, CREATE USER ON *.* TO `labsdbadmin`@`10.64.37.19` IDENTIFIED BY PASSWORD 'somethingsomethingsomethingsomethingsomet' WITH GRANT OPTION |
| GRANT SELECT, INSERT, UPDATE ON `mysql`.* TO `labsdbadmin`@`10.64.37.19`                                                                            |
| GRANT SELECT, SHOW VIEW ON `%wik%`.* TO `labsdbadmin`@`10.64.37.19`                                                                                 |
| GRANT SELECT, SHOW VIEW ON `%_p`.* TO `labsdbadmin`@`10.64.37.19` WITH GRANT OPTION                                                                 |
+-----------------------------------------------------------------------------------------------------------------------------------------------------+

And the instances we need access to are:

clouddb1013.eqiad.wmnet:3311
clouddb1013.eqiad.wmnet:3313
clouddb1014.eqiad.wmnet:3312
clouddb1014.eqiad.wmnet:3317
clouddb1015.eqiad.wmnet:3314
clouddb1015.eqiad.wmnet:3316
clouddb1016.eqiad.wmnet:3315
clouddb1016.eqiad.wmnet:3318
clouddb1017.eqiad.wmnet:3311
clouddb1017.eqiad.wmnet:3313
clouddb1018.eqiad.wmnet:3312
clouddb1018.eqiad.wmnet:3317
clouddb1019.eqiad.wmnet:3314
clouddb1019.eqiad.wmnet:3316
clouddb1020.eqiad.wmnet:3315
clouddb1020.eqiad.wmnet:3318
clouddb1021.eqiad.wmnet:3311
clouddb1021.eqiad.wmnet:3312
clouddb1021.eqiad.wmnet:3313
clouddb1021.eqiad.wmnet:3314
clouddb1021.eqiad.wmnet:3315
clouddb1021.eqiad.wmnet:3316
clouddb1021.eqiad.wmnet:3317
clouddb1021.eqiad.wmnet:3318

Thanks!

Event Timeline

cc. @BTullis in case you are managing this things too

Marostegui triaged this task as Medium priority.
Marostegui moved this task from Triage to In progress on the DBA board.
Marostegui subscribed.

@dcaro to confirm, the user currently has access from labstore1005.eqiad.wmnet and labstore1004.eqiad.wmnet?

@Marostegui yes, currently those are the ones accessing the DBs yes, those will go away once we have done the migration to the new servers.

Change 893752 had a related patch set uploaded (by David Caro; author: David Caro):

[operations/puppet@production] wikireplicas: add GRANTS for cloudcontrols to replace labstore1004

https://gerrit.wikimedia.org/r/893752

@Marostegui you were quick :), note that I've sent a patch and modified the task to include all the cloudcontrols in eqiad (we want to be able to fallback on them).

Change 893753 had a related patch set uploaded (by Marostegui; author: Marostegui):

[operations/puppet@production] wiki-replicas.sql: Add new grants

https://gerrit.wikimedia.org/r/893753

@Marostegui you were quick :), note that I've sent a patch and modified the task to include all the cloudcontrols in eqiad (we want to be able to fallback on them).

Haha I also sent one :). I will review yours and merge if it looks good.

Change 893752 merged by Marostegui:

[operations/puppet@production] wikireplicas: add GRANTS for cloudcontrols to replace labstore1004

https://gerrit.wikimedia.org/r/893752

Change 893753 abandoned by Marostegui:

[operations/puppet@production] wiki-replicas.sql: Add new grants

Reason:

Done at 893752

https://gerrit.wikimedia.org/r/893753

This is done, please reopen if it is not working