For some time now, we've been creating Puppet templated files of Cassandra DDL statements, to create roles (users), and grant permissions (see: modules/cassandra/templates/users/). Each .cql file is templated with credentials from /srv/private.git and installed on the apropos cluster hosts. This practice predates the creation of the aqsloader though, so we need to create a template for it as well.
Description
Description
Details
Details
Related Changes in Gerrit:
Customize query in gerrit
Related Objects
Related Objects
- Mentioned In
- T305600: Properly add aqsloader user (w/ secrets)
T142073: Improve user management for AQS Cassandra
T356400: User aqsloader hasn't MODIFY permissions on image_suggestions.* Cassandra tables anymore
rLPRI0668b9e2a6cb: added (fake) aqsloader creds (Cassandra role) - Mentioned Here
- T305600: Properly add aqsloader user (w/ secrets)
T313877: Audit and update AQS Cassandra roles & grants
T355921: Generated Data Platform (neé AQS): aqs & aqsloader roles need more specific grants
T356400: User aqsloader hasn't MODIFY permissions on image_suggestions.* Cassandra tables anymore
Event Timeline
Comment Actions
Change 993102 had a related patch set uploaded (by Eevans; author: Eevans):
[operations/puppet@production] cassandra: create template for aqsloader role & grants
Comment Actions
Change 993105 had a related patch set uploaded (by Eevans; author: Eevans):
[labs/private@master] added (fake) aqsloader creds (Cassandra role)
Comment Actions
Change 993105 merged by Eevans:
[labs/private@master] added (fake) aqsloader creds (Cassandra role)
Comment Actions
Change 994225 had a related patch set uploaded (by Eevans; author: Eevans):
[operations/puppet@production] cassandra: cassandra roles for druid-based aqs endpoints
Comment Actions
Change 993102 merged by Eevans:
[operations/puppet@production] cassandra: create template for aqsloader role & grants
Comment Actions
Change 994820 had a related patch set uploaded (by Eevans; author: Eevans):
[operations/puppet@production] cassandra: fix erroneous DDL syntax for GRANTs
Comment Actions
Change 994820 merged by Eevans:
[operations/puppet@production] cassandra: fix erroneous DDL syntax for GRANTs
Comment Actions
This has been applied; Let me know if you notice any problems.
cassandra@cqlsh> LIST ALL PERMISSIONS OF aqsloader; role | username | resource | permission -----------+-----------+-------------------------------------------------------------+------------ aqsloader | aqsloader | <keyspace aqs> | SELECT aqsloader | aqsloader | <keyspace aqs> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_editors_bycountry> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_editors_bycountry> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_knowledge_gap_by_category> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_knowledge_gap_by_category> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_lgc_pagecounts_per_project> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_lgc_pagecounts_per_project> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_mediarequest_per_file> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_mediarequest_per_file> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_mediarequest_per_referer> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_mediarequest_per_referer> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_mediarequest_top_files> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_mediarequest_top_files> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_pageviews_per_article_flat> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_pageviews_per_article_flat> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_pageviews_per_project_v2> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_pageviews_per_project_v2> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_top_bycountry> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_top_bycountry> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_top_pageviews> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_top_pageviews> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_top_percountry> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_top_percountry> | MODIFY aqsloader | aqsloader | <keyspace local_group_default_T_unique_devices> | SELECT aqsloader | aqsloader | <keyspace local_group_default_T_unique_devices> | MODIFY (26 rows) cassandra@cqlsh>