Page MenuHomePhabricator

Remove wmcs-admin access from production cumin hosts
Open, Stalled, LowPublic

Description

Now that cloudcumin hosts are available, we should remove the wmcs-admin group from hieradata/role/common/cluster/management.yaml.

Before we want to make sure the members of that group can use cloudcumins to run the same commands they can now run from production cumin hosts: T347977: cloudcumin: allow wmcs-admin to run wikireplicas cookbooks and scripts.

Another reason why members of wmcs-admin might need to SSH to production cumin hosts is to downtime alerts through the alertmanager API. So we should also complete T347490: [wmcs-cookbooks] Downtime alerts from cloudcumins before this task can be started.