This is currently blocked by T347977: cloudcumin: allow wmcs-admin to run wikireplicas cookbooks and scripts

Until that task is done, members of the wmcs-admin group cannot use cloudcumin hosts to run the wikireplica cookbooks (sre.wikireplicas.*) and have to use the production cumin hosts.

What's the future of this now that T347977: cloudcumin: allow wmcs-admin to run wikireplicas cookbooks and scripts was declined?

@taavi good question! Given that wikireplica hosts are not owned by a single team, my suggestion would be to keep the wikireplicas cookbooks in production cumins, and replace the wmcs-admin group with a new wikireplica-admins group that explicitly lists users that are not global roots but should be able to run the wikireplicas cookbooks. This group should not inherit users from wmcs-roots, but instead from the existing group wikireplica-roots.

We should also define a process for adding more users to both the wikreplica-admins and wikireplica-roots groups, who should approve new members to the groups and what are the requirements to become a member? I think this will have to happen along the current discussions about who should be reviewing and applying patches to wikireplica views, e.g. https://gerrit.wikimedia.org/r/c/operations/puppet/+/1073430

If there is some consensus around this plan, I will create a task and the related patch to implement it.