Rename gerrit2 unix user to gerrit and assign a fixed uid
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	hashar
	Jun 8 2023, 3:00 PM

Project Tags

Referenced Files

	F72153393: image.png
	Feb 17 2026, 2:11 PM

Subscribers

Description

When switching over Gerrit (ex: T326368 ) we have to rsync the LFS data, search indices and cache which requires a follow up chown -R gerrit2 on each affected base paths. Using a central fixed uid for the user would save us from having to do the chown.

While changing the uid, I'd like to also rename the user from the confusing gerrit2 to gerrit.

Instances

gerrit2003.wikimedia.org
gerrit1003.wikimedia.org https://gerrit.wikimedia.org/r/c/operations/puppet/+/1240219
gerrit2002.wikimedia.org https://gerrit.wikimedia.org/r/1242275

Details

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
gerrit: cleanup Hiera and tests after gerrit2 renaming	Dzahn	operations/puppet	production	+6 -7
admin: rename gerrit system user	Dzahn	operations/puppet	production	+1 -1
backup: adjust gerrit file set after renaming of gerrit2	Dzahn	operations/puppet	production	+1 -1
gerrit: remove code for having multiple daemon users	Dzahn	operations/puppet	production	+5 -15
gerrit: migrate gerrit2 system user to gerrit	Arnaudb	operations/puppet	production	+4 -4
gerrit: change daemon user for gerrit1003	Arnaudb	operations/puppet	production	+9 -0
gerrit: Switchover gerrit1003 → gerrit2003	Arnaudb	operations/puppet	production	+134 -65
gerrit: Switchover gerrit1003 → gerrit2003	Arnaudb	operations/puppet	production	+79 -40
gerrit: Switchover gerrit1003 → gerrit2003	Arnaudb	operations/puppet	production	+79 -40
gerrit: Switchover gerrit1003 → gerrit2003	Arnaudb	operations/puppet	production	+70 -33
gerrit: Switchover gerrit1003 → gerrit2003	Arnaudb	operations/puppet	production	+46 -30
gerrit: site.pp cleanup	Arnaudb	operations/puppet	production	+1 -6
Gerrit: Add service ip for gerrit2003	Arnaudb	operations/dns	master	+8 -3
Revert^2 "gerrit: add a second replica, start replicating to gerrit2003"	Dzahn	operations/puppet	production	+16 -8
gerrit: introduce second daemon_user name	Dzahn	operations/puppet	production	+3 -2
Revert "gerrit: add a second replica, start replicating to gerrit2003"	Hashar	operations/puppet	production	+8 -16
gerrit: set gerrit site dir Hiera value for new machine gerrit2003	Dzahn	operations/puppet	production	+3 -0
gerrit: add chown parameter to lfs data rsync, ensure daemon_user is used	Dzahn	operations/puppet	production	+1 -0
devtools: update gerrit user from gerrit2 to gerrit	Dzahn	operations/puppet	production	+3 -3
backup: add /var/lib/gerrit to gerrit repodata backup filesets	Dzahn	operations/puppet	production	+1 -1
gerrit: use systemd::sysuser, reserved UID/GID, new name for daemon user	Dzahn	operations/puppet	production	+26 -11
admin: reserve gerrit uid/gid	Hashar	operations/puppet	production	+19 -2

Related Objects
Search...

Status	Assigned	Task
		Restricted Task
Resolved	Dzahn	T411895 gerrit behind CDN
Resolved	ABran-WMF	T420523 ProbeDown - Service gerrit2003:443 has failed probes (http_gerrit_tls_ip6)
		Restricted Task
		Restricted Task
Open	None	T392448 Upgrade to Gerrit 3.12
Open	None	T407557 OpenSSH 10.1+ warns that Wikimedia SSH does not use post-quantum key exchange algorithm
Stalled	None	T407844 Gerrit ssh daemon does not offer post-quantum kex leading to a warning with OpenSSH 10
		Restricted Task
Open	None	T379714 Upgrade to Gerrit 3.11
Open	None	T392465 Switch Gerrit from Java 17 to Java 21
		Unknown Object (Task)
Resolved	Jhancock.wm	T369670 Q1:rack/setup/install gerrit2003
Resolved	Dzahn	T384595 Upgrade Collab hosts to Bookworm
Resolved	ABran-WMF	T392464 Upgrade Gerrit hosts from Bullseye to Bookworm
Resolved	Dzahn	T372804 setup gerrit2003 with gerrit service (gerrit on bookworm)
Open	None	T387831 Standardize failover procedures for Collab services
Resolved	None	T393239 ProbeDown
Resolved	ABran-WMF	T387833 Gerrit switchover process
Resolved	ABran-WMF	T260666 Create a cookbook to automate gerrit's switchover
Resolved	ABran-WMF	T338470 Rename gerrit2 unix user to gerrit and assign a fixed uid
Resolved	Dzahn	T379213 PuppetFailure - gerrit2003
Open	None	T417642 Rename gerrit2 Gerrit user to gerrit in the administrator group

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes

Dzahn added a parent task: T372804: setup gerrit2003 with gerrit service (gerrit on bookworm).Oct 24 2024, 12:42 AM

Mentioned in SAL (#wikimedia-operations) [2024-10-24T00:44:28Z] <dzahn@cumin2002> START - Cookbook sre.hosts.downtime for 14 days, 0:00:00 on gerrit2003.wikimedia.org with reason: in setup and T338470

Mentioned in SAL (#wikimedia-operations) [2024-10-24T00:44:43Z] <dzahn@cumin2002> END (PASS) - Cookbook sre.hosts.downtime (exit_code=0) for 14 days, 0:00:00 on gerrit2003.wikimedia.org with reason: in setup and T338470

This also needs to be fixed. It's the parameters of the rsync command for LFS syncing.

Notice: /Stage[main]/Gerrit/File[/srv/gerrit/data/lfs]/owner: owner changed 498 to 'gerrit' (corrective)
Notice: /Stage[main]/Gerrit/File[/srv/gerrit/data/lfs]/group: group changed 1001 to 'gerrit' (corrective)

Change #1087950 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] backup: add /var/lib/gerrit to gerrit repodata backup filesets

https://gerrit.wikimedia.org/r/1087950

gerritbot added a project: Patch-For-Review.Nov 6 2024, 5:12 PM

Change #1087950 merged by Dzahn:

[operations/puppet@production] backup: add /var/lib/gerrit to gerrit repodata backup filesets

https://gerrit.wikimedia.org/r/1087950

Maintenance_bot removed a project: Patch-For-Review.Nov 6 2024, 5:31 PM

Change #1087963 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] devtools: update gerrit user from gerrit2 to gerrit

https://gerrit.wikimedia.org/r/1087963

gerritbot added a project: Patch-For-Review.Nov 6 2024, 7:41 PM

Change #1087967 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] gerrit: add chown parameter to lfs data rsync, ensure daemon_user is used

https://gerrit.wikimedia.org/r/1087967

Change #1087963 merged by Dzahn:

[operations/puppet@production] devtools: update gerrit user from gerrit2 to gerrit

https://gerrit.wikimedia.org/r/1087963

Dzahn mentioned this in T379213: PuppetFailure - gerrit2003.Nov 7 2024, 6:03 PM

Dzahn added a subtask: T379213: PuppetFailure - gerrit2003.

Change #1087967 merged by Dzahn:

[operations/puppet@production] gerrit: add chown parameter to lfs data rsync, ensure daemon_user is used

https://gerrit.wikimedia.org/r/1087967

Maintenance_bot removed a project: Patch-For-Review.Nov 7 2024, 6:30 PM

Change #1088613 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] gerrit: set gerrit site dir Hiera value for new machine gerrit2003

https://gerrit.wikimedia.org/r/1088613

gerritbot added a project: Patch-For-Review.Nov 8 2024, 7:05 PM

Change #1088613 merged by Dzahn:

[operations/puppet@production] gerrit: set gerrit site dir Hiera value for new machine gerrit2003

https://gerrit.wikimedia.org/r/1088613

Maintenance_bot removed a project: Patch-For-Review.Nov 8 2024, 9:30 PM

This is fixed for NEW gerrit machines but we are not changing it for the existing gerrit server. So now this is about getting gerrit2003 (T372804) into production and shutting down the old hardware.

ABran-WMF mentioned this in T387833: Gerrit switchover process.Mar 13 2025, 8:37 AM

Dzahn mentioned this in T392464: Upgrade Gerrit hosts from Bullseye to Bookworm.Apr 24 2025, 12:42 AM

Dzahn removed Dzahn as the assignee of this task.May 22 2025, 8:04 PM

ABran-WMF added parent tasks: T387833: Gerrit switchover process, T260666: Create a cookbook to automate gerrit's switchover.May 23 2025, 5:39 AM

ABran-WMF subscribed.

Change #1152810 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] gerrit: introduce second daemon_user name

https://gerrit.wikimedia.org/r/1152810

gerritbot added a project: Patch-For-Review.Jun 2 2025, 7:46 PM

Change #1153159 had a related patch set uploaded (by Hashar; author: Hashar):

[operations/puppet@production] Revert "gerrit: add a second replica, start replicating to gerrit2003"

https://gerrit.wikimedia.org/r/1153159

Change #1153159 merged by AOkoth:

[operations/puppet@production] Revert "gerrit: add a second replica, start replicating to gerrit2003"

https://gerrit.wikimedia.org/r/1153159

hashar mentioned this in T395887: github mirror out of sync.Jun 3 2025, 3:02 PM

Change #1152810 abandoned by Dzahn:

[operations/puppet@production] gerrit: introduce second daemon_user name

Reason:

will make a new simpler patch rebased on top of a re-revert of the replication config change

https://gerrit.wikimedia.org/r/1152810

Maintenance_bot removed a project: Patch-For-Review.Jun 3 2025, 7:31 PM

Change #1153265 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] Revert^2 "gerrit: add a second replica, start replicating to gerrit2003"

https://gerrit.wikimedia.org/r/1153265

gerritbot added a project: Patch-For-Review.Jun 4 2025, 7:08 PM

Change #1153265 merged by Dzahn:

[operations/puppet@production] Revert^2 "gerrit: add a second replica, start replicating to gerrit2003"

https://gerrit.wikimedia.org/r/1153265

Maintenance_bot removed a project: Patch-For-Review.Jul 7 2025, 5:32 PM

ABran-WMF mentioned this in T372804: setup gerrit2003 with gerrit service (gerrit on bookworm).Jul 9 2025, 9:26 AM

Change #1172625 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

https://gerrit.wikimedia.org/r/1172625

gerritbot added a project: Patch-For-Review.Jul 25 2025, 12:57 PM

Change #1173376 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/dns@master] Gerrit: Add service ip for gerrit2003

https://gerrit.wikimedia.org/r/1173376

Change #1173376 merged by Dzahn:

[operations/dns@master] Gerrit: Add service ip for gerrit2003

https://gerrit.wikimedia.org/r/1173376

Change #1174671 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: site.pp cleanup

https://gerrit.wikimedia.org/r/1174671

Change #1174671 merged by Dzahn:

[operations/puppet@production] gerrit: site.pp cleanup

https://gerrit.wikimedia.org/r/1174671

Change #1188351 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

https://gerrit.wikimedia.org/r/1188351

Change #1172625 abandoned by Arnaudb:

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

Reason:

replaced by 1188351

https://gerrit.wikimedia.org/r/1172625

Shouldn't the status of this task be changed from stalled?

good catch, indeed!

ABran-WMF claimed this task.Oct 2 2025, 12:06 PM

Change #1188351 merged by Arnaudb:

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

https://gerrit.wikimedia.org/r/1188351

Maintenance_bot removed a project: Patch-For-Review.Oct 6 2025, 12:31 PM

hashar mentioned this in T406762: gerrit2003 is trying to backup incrementally 3.5 million files every hour, clogging backus and filling in available disk space.Oct 9 2025, 1:06 PM

Change #1211548 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

https://gerrit.wikimedia.org/r/1211548

Change #1211548 abandoned by Arnaudb:

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

Reason:

forgot a step

https://gerrit.wikimedia.org/r/1211548

Change #1211549 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

https://gerrit.wikimedia.org/r/1211549

Change #1217133 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

https://gerrit.wikimedia.org/r/1217133

Change #1211549 abandoned by Arnaudb:

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

Reason:

1217133

https://gerrit.wikimedia.org/r/1211549

Change #1217133 merged by Arnaudb:

[operations/puppet@production] gerrit: Switchover gerrit1003 → gerrit2003

https://gerrit.wikimedia.org/r/1217133

Maintenance_bot removed a project: Patch-For-Review.Feb 16 2026, 10:31 AM

ABran-WMF updated the task description. (Show Details)Feb 17 2026, 2:09 PM

For the sake of naming harmonization, we should probably also rename the gerrit2 administrator account which will become more and more confusing after we finish changing the system user

ABran-WMF created subtask T417642: Rename gerrit2 Gerrit user to gerrit in the administrator group.Feb 17 2026, 2:14 PM

ABran-WMF mentioned this in T417642: Rename gerrit2 Gerrit user to gerrit in the administrator group.

In T338470#11622962, @ABran-WMF wrote:

rename the gerrit2 administrator account

This is not possible via web UI.

It would involve roughly:

git clone the special "All-Users" repo
fetch/checkout the "refs/meta/external-ids" branch
find the line like "[externalId "username:gerrit2"]"
edit the file and rename it to a SHA1 hash of itself. (echo -n "username:NewName" | sha1sum ?)
git commit and push to origin
re-index the accounts (ssh -p 29418 <host> gerrit index start accounts <account-id> ?)

Not sure if that's worth it.

In T338470#11622962, @ABran-WMF wrote:

For the sake of naming harmonization, we should probably also rename the gerrit2 administrator account which will become more and more confusing after we finish changing the system user

I have filed this task for renaming the Unix user.

For the Gerrit user, we do not rename users ever, that is asking for too many issues. But please file another task for this and we can investigate.

That other task is T417642

Change #1240219 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: change daemon user for gerrit1003

https://gerrit.wikimedia.org/r/1240219

Change #1240219 merged by Arnaudb:

[operations/puppet@production] gerrit: change daemon user for gerrit1003

https://gerrit.wikimedia.org/r/1240219

ABran-WMF updated the task description. (Show Details)Feb 18 2026, 9:52 AM

ABran-WMF updated the task description. (Show Details)

Maintenance_bot removed a project: Patch-For-Review.Feb 18 2026, 10:31 AM

ABran-WMF moved this task from Backlog to Work in Progress on the Collaboration-Services board.Feb 19 2026, 1:58 PM

Change #1242275 had a related patch set uploaded (by Arnaudb; author: Arnaudb):

[operations/puppet@production] gerrit: prepare replication resume for gerrit2002

https://gerrit.wikimedia.org/r/1242275

gerritbot added a project: Patch-For-Review.Feb 23 2026, 9:41 AM

ABran-WMF updated the task description. (Show Details)Feb 23 2026, 9:46 AM

Change #1242467 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] gerrit: remove code for having multiple daemon users

https://gerrit.wikimedia.org/r/1242467

Change #1242275 merged by Arnaudb:

[operations/puppet@production] gerrit: migrate gerrit2 system user to gerrit

https://gerrit.wikimedia.org/r/1242275

ABran-WMF closed this task as Resolved.Feb 24 2026, 2:18 PM

ABran-WMF updated the task description. (Show Details)

There are still a bunch of occurences for gerrit2 in Puppet, notably the backup had a hardcoded /var/lib/gerrit2 but it is fine because it already has /var/lib/gerrit.

The whole $daemon_user can be removed from the profile and the gerrit module in favor of hardcoding it to gerrit. I made it a variable https://gerrit.wikimedia.org/r/c/operations/puppet/+/832345 but it is no more necessary.

I don't know about:

modules/admin/data/system_users.txt

gerrit2

Maybe it has to be kept.

$ git grep '\bgerrit2\b'
hieradata/common/profile/gerrit/migration.yaml:profile::gerrit::migration::daemon_user: 'gerrit2'
hieradata/hosts/gerrit1003.yaml:# different system user gerrit2 -> gerrit (T338470)
hieradata/hosts/gerrit2003.yaml:# different system user gerrit2 -> gerrit (T338470)
modules/admin/data/system_users.txt:gerrit2
modules/gerrit/spec/classes/gerrit_spec.rb:          daemon_user:   'gerrit2',
modules/gerrit/spec/classes/gerrit_spec.rb:          gerrit_site:   '/var/lib/gerrit2/review_site',
modules/gerrit/spec/classes/gerrit_spec.rb:            'ssh://gerrit2@gerrit1002.example.org:29418',
modules/gerrit/templates/gerrit.config.erb:    # The `gerrit2` user is in the Administators group on Gerrit
modules/profile/manifests/backup/filesets.pp:        includes => [ '/srv/gerrit', '/var/lib/gerrit2', '/var/lib/gerrit' ]
modules/profile/manifests/gerrit.pp:    String                            $service_account              = lookup('profile::gerrit::service_account', { 'default_value' => 'gerrit2' }),
modules/profile/manifests/gerrit.pp:    # given the volume of moving parts in the gerrit → gerrit2 migration, lets be explicit
modules/profile/manifests/gerrit.pp:    $local_daemon_user          = pick($daemon_users[$fqdn],                $daemon_user, 'gerrit2')
modules/profile/manifests/gerrit.pp:    $ssh_account_replica        = pick($daemon_users[$replica_host],        $daemon_user, 'gerrit2')
modules/profile/manifests/gerrit.pp:    $ssh_account_spare          = pick($daemon_users[$spare_host],          $daemon_user, 'gerrit2')
modules/profile/spec/classes/profile_gerrit_proxy_spec.rb:        gerrit_site = '/var/lib/gerrit2/review_site'
modules/profile/spec/classes/profile_gerrit_spec.rb:          daemon_user: 'gerrit2',

Change #1242467 merged by Dzahn:

[operations/puppet@production] gerrit: remove code for having multiple daemon users

https://gerrit.wikimedia.org/r/1242467

Change #1243183 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] backup: adjust gerrit file set after renaming of gerrit2

https://gerrit.wikimedia.org/r/1243183

Change #1243187 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] gerrit: cleanup Hiera and tests after gerrit2 renaming

https://gerrit.wikimedia.org/r/1243187

Change #1243188 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] admin: rename gerrit system user

https://gerrit.wikimedia.org/r/1243188

Change #1243187 merged by Dzahn:

[operations/puppet@production] gerrit: cleanup Hiera and tests after gerrit2 renaming

https://gerrit.wikimedia.org/r/1243187

Change #1243183 merged by Dzahn:

[operations/puppet@production] backup: adjust gerrit file set after renaming of gerrit2

https://gerrit.wikimedia.org/r/1243183

Change #1243188 merged by Dzahn:

[operations/puppet@production] admin: rename gerrit system user

https://gerrit.wikimedia.org/r/1243188

Maintenance_bot removed a project: Patch-For-Review.Feb 25 2026, 6:30 PM

marking this as resolved, thanks @Dzahn for the patches!

$ git grep '\bgerrit2\b'
hieradata/common/profile/gerrit.yaml:profile::gerrit::service_account: 'gerrit2'
hieradata/hosts/gerrit2003.yaml:# different system user gerrit2 -> gerrit (T338470)
modules/gerrit/templates/gerrit.config.erb:    # The `gerrit2` user is in the Administators group on Gerrit
modules/profile/manifests/gerrit.pp:    String                            $service_account              = lookup('profile::gerrit::service_account', { 'default_value' => 'gerrit2' }),

Dzahn awarded a token.Mar 3 2026, 2:51 PM

Rename gerrit2 unix user to gerrit and assign a fixed uidClosed, ResolvedPublicActions

Description

Instances

Details

Related ObjectsSearch...

Event Timeline

Rename gerrit2 unix user to gerrit and assign a fixed uid
Closed, ResolvedPublic
Actions

Related Objects
Search...