https://gerrit.wikimedia.org/g/operations/puppet/+/refs/heads/production/modules/profile/templates/mariadb/grants/production-m5.sql.erb#26

It's possible that the grants are already covered by the proxies listed here, but it would be good to check before we start our migration

There is a problem before we can even check the grants, there's no connection between those two hosts and the proxies. I guess a FW rules needs to be added somewhere:

root@lists1004:/etc# telnet dbproxy1021.eqiad.wmnet 3306
Trying 10.64.32.180...


# telnet dbproxy2001.codfw.wmnet 3306
Trying 10.192.0.129...

And this is the current host:

# telnet dbproxy1021.eqiad.wmnet 3306
Trying 10.64.32.180...
Connected to dbproxy1021.eqiad.wmnet.
Escape character is '^]'.
]
5.5.5-10.6.16-MariaDB-log'�t&DeN9qOs�y&L.?5)lhDYtmysql_native_passwordConnection closed by foreign host.

That's right -- we'll be doing that as part of the maintenance work later today. We kept them firewalled off so that the non-active host isn't writing to the database at the same time as the active. In the future it might make more sense to allow all hosts access but have a read/write user for the active host, and read only for the non-active.

https://gerrit.wikimedia.org/r/c/operations/puppet/+/1046785
https://phabricator.wikimedia.org/T367521

Yes, we have that RW and RO users in other services.

This is done I think but then maybe we should drop the grant on lists1001 then?

In T367833#9903360, @Ladsgroup wrote:

This is done I think but then maybe we should drop the grant on lists1001 then?

+1 - we should review puppet grants in case we mention lists1001 somewhere

Change #1047474 had a related patch set uploaded (by Ladsgroup; author: Amir Sarabadani):

[operations/puppet@production] mariadb: Remove direct grants on mailman databases

https://gerrit.wikimedia.org/r/1047474

Change #1047474 merged by Ladsgroup:

[operations/puppet@production] mariadb: Remove direct grants on mailman databases

https://gerrit.wikimedia.org/r/1047474