Page MenuHomePhabricator

Grant Access to analytics-privatedata-users for ATsay-WMF
Closed, ResolvedPublic

Description

Requestor provided information and prerequisites

This section is to be completed by the individual requesting access.

  • Wikitech username: ATsay-WMF
  • Email address: atsay@wikimedia.org
  • SSH public key (must be a separate key from Wikimedia cloud SSH access): N/A
  • Requested group membership: analytics-privatedata-users
  • Reason for access: Superset
  • Name of approving party (manager for WMF/WMDE staff): @SDeckelmann-WMF
  • Ensure you have read the Analytics Data Access User Responsibilities.
  • Please coordinate obtaining a comment of approval on this task from the approving party.

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

  • - User has read the Analytics Data Access User Responsibilities.
  • - User has a valid NDA on file with WMF legal. (All WMF Staff/Contractor hiring are covered by NDA. Other users can be validated via the NDA tracking sheet)
  • - User has provided the following: wikitech username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
  • - User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not shared with any other service (this includes not sharing with WMCS access, no shared keys.)
  • - The provided SSH key has been confirmed out of band and is verified not being used in WMCS.
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponsor for volunteers, manager for wmf staff)
  • - access request (or expansion) has sign off of group approver indicated by the approval field in data.yaml

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Event Timeline

colewhite subscribed.

Hi!

Currently there is no ldap account associated with your work email. First thing to try is to create a wikitech account here and confirm the email.

Change 948686 had a related patch set uploaded (by Cwhite; author: Cwhite):

[operations/puppet@production] admin: add amyt to ldap_only_users

https://gerrit.wikimedia.org/r/948686

Hi,

While we add your user to the base group, can you make sure you have:

Tagging @odimitrijevic and @Milimetric for analytics-privatedata-users group approval.

We would also need clarification on whether this request is also for SSH access or only via superset.

Clement_Goubert changed the task status from Open to In Progress.Aug 17 2023, 9:01 AM
jbond subscribed.

@ATsay-WMF i have added you to the ldap wmf group which should give you access to superset. If you need additional access please reopen this task thanks

Change 948686 merged by Cwhite:

[operations/puppet@production] admin: add amyt to ldap_only_users

https://gerrit.wikimedia.org/r/948686

Hello, I'd like to request access to analytics-privatedata-users as well. Thanks!

This comment was removed by jbond.

Hello, I'd like to request access to analytics-privatedata-users as well. Thanks!

Please disregard my last comment however can you describe what it is you need to access. There are 3 different ways to add users to the analytics-privatedata-users group so knowing specifically what you need to access is usefull

Jelto triaged this task as Medium priority.Oct 6 2023, 11:49 AM
Jelto subscribed.

We have approval from manager and group owner already for analytics-privatedata-users. So we can proceed with adding amyt to analytics-privatedata-users.

Change 964000 had a related patch set uploaded (by Jelto; author: Jelto):

[operations/puppet@production] admin: add amyt to analytics-privatedata-users

https://gerrit.wikimedia.org/r/964000

Per discussion in https://gerrit.wikimedia.org/r/c/operations/puppet/+/964000/1#message-e8640992dffe84a96eb65107b8dcfbff5728927b it would be good to get another formal approval for adding amyt to analytics-privatedata-users (as the initial request was ldap only).

@odimitrijevic or @Milimetric may I ask you for another approval to add amyt to analytics-privatedata-users (which includes superset with private data).

Hello, I'd like to request access to analytics-privatedata-users as well. Thanks!

Hi @ATsay-WMF, there are multiple types of analytics-privatedata-users access - depending on what service/data you actually want to access (see https://wikitech.wikimedia.org/wiki/Analytics/Data_access#What_access_should_I_request?). I will assume it's just about the superset/hive access with PII and go with the change @Jelto prepared. If you need SSH/Kerberos access as well, please let us know.

Change 964000 merged by JMeybohm:

[operations/puppet@production] admin: add amyt to analytics-privatedata-users

https://gerrit.wikimedia.org/r/964000

JMeybohm updated the task description. (Show Details)

I just needed to see the superset dashboard, and it's working now--thank you!