The members of the group wmcs-admin can currently SSH to cumin1001 to run the following commands:
root@cumin1001:~# cat /etc/sudoers.d/wmcs-admin # This file is managed by Puppet! %wmcs-admin ALL = (ALL) NOPASSWD: /usr/local/bin/secure-cookbook sre.wikireplicas.* %wmcs-admin ALL = (ALL) NOPASSWD: /usr/local/sbin/maintain-views %wmcs-admin ALL = (ALL) NOPASSWD: /usr/local/sbin/maintain-meta_p %wmcs-admin ALL = (ALL) NOPASSWD: /usr/local/sbin/maintain-replica-indexes
In T325067 I merged a patch that replicated those sudoers rule to the new cloudcumin hosts. This task is to ensure that all those scripts can be run successfully from the cloudcumin hosts. At a minimum, we have to add the secure-cookbook command that is not present right now, but there might be more things to fix.