Page MenuHomePhabricator
Create Task
Maniphest T373379

Requesting access to airflow-analytics-product-admins group for jiawang
Closed, ResolvedPublic
Actions

Description

Requestor provided information and prerequisites

Complete ALL items below as the individual person who is requesting access:

  • Wikimedia developer account username: jiawang
  • Email address: jwang@wikimedia.org
  • SSH public key (must be a separate key from Wikimedia cloud SSH access):
  • Requested group membership: deployment
  • Reason for access: be able to deploy airflow pipeline
  • Name of approving party (manager for WMF/WMDE staff): Mikhail Popov
  • Ensure you have signed the L3 Wikimedia Server Access Responsibilities document: [added by SRE]: yes
  • Please coordinate obtaining a comment of approval on this task from the approving party.

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

  • - User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • - User has a valid NDA on file with WMF legal. (All WMF Staff/Contractor hiring are covered by NDA. Other users can be validated via the NDA tracking sheet)
  • - User has provided the following: developer account username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
  • - User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not shared with any other service (this includes not sharing with WMCS access, no shared keys.)
  • - The provided SSH key has been confirmed out of band and is verified not being used in WMCS.
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponsor for volunteers, manager for wmf staff)
  • - access request (or expansion) has sign off of group approver indicated by the approval field in data.yaml

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Details

Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
admin.yaml: jiawang change groupsEffie Mouzelioperations/puppetproduction+2 -2
admin: add jiawang to deployment groupSsinghoperations/puppetproduction+1 -1
Customize query in gerrit

Related Objects

Event Timeline

jwang created this task.Aug 26 2024, 5:55 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 26 2024, 5:55 PM
jwang mentioned this in T364417: deploy1003 implementation tracking.Aug 26 2024, 5:56 PM
Dzahn subscribed.EditedAug 26 2024, 5:58 PM

Hi @jwang

the request from the past you are referencing is for a different type of access.

That was for the " Requested group membership: analytics-privatedata-users, researchers & wmf".

These are separate from deployment access. There isn't just one type of production access but actually many different groups.

So what you are requesting now is a new group, called deployment in addition to your existing groups above.

Dzahn added a comment.Aug 26 2024, 6:02 PM

Ideally if you could use this form for access requests please:

https://phabricator.wikimedia.org/maniphest/task/edit/form/8/

Since you already made this one you can also just copy/paste the form fields from there over here and fill it out.

Thanks!

ssingh subscribed.Aug 26 2024, 6:04 PM

Thanks @Dzahn!

@jwang: Happy to take care of the request once you file the task and the approvals are in.

jwang updated the task description. (Show Details)Aug 26 2024, 6:35 PM
jwang renamed this task from Failed to ssh deployment.eqiad.wmnet to Requesting access to deployment group for jwang.Aug 26 2024, 6:48 PM
jwang updated the task description. (Show Details)
jwang added a comment.Aug 26 2024, 6:55 PM

SSH public key

prod_id_ed25519.pub115 BDownload

ssingh added subscribers: mpopov, thcipriani.Aug 26 2024, 7:03 PM

@thcipriani: this requires your approval, thanks! @mpopov (approving manager) already added.

gerritbot added a comment.Aug 26 2024, 7:05 PM

Change #1066833 had a related patch set uploaded (by Ssingh; author: Ssingh):

[operations/puppet@production] admin: add jiawang to deployment group

https://gerrit.wikimedia.org/r/1066833

gerritbot added a project: Patch-For-Review.Aug 26 2024, 7:05 PM
ssingh updated the task description. (Show Details)Aug 26 2024, 7:05 PM
jwang added a comment.Aug 26 2024, 8:54 PM

Hi @ssingh, my manager @mpopov is on PTO in the following two weeks. Can I ask his manager for approval, or is there someone else I should ask?

Reedy renamed this task from Requesting access to deployment group for jwang to Requesting access to deployment group for jwang.Aug 26 2024, 8:55 PM
jwang renamed this task from Requesting access to deployment group for jwang to Requesting access to deployment group for jiawang.Aug 26 2024, 8:58 PM
ssingh added a comment.Aug 26 2024, 9:04 PM
In T373379#10094161, @jwang wrote:

Hi @ssingh, my manager @mpopov is on PTO in the following two weeks. Can I ask his manager for approval, or is there someone else I should ask?

That works, thank you! (Asking their manager or your manager's delegate when they are out, if any.)

jwang added a subscriber: kzimmerman.Aug 26 2024, 9:20 PM

@kzimmerman, can you approve it while @mpopov is out?

kzimmerman added a comment.Aug 26 2024, 9:44 PM

Approved as Mikhail's manager!

(Mikhail has mentioned the needs to deploy Airflow pipelines. Let me know if other questions come up that I can help with.)

ssingh added a comment.Aug 27 2024, 1:01 PM

Thanks @kzimmerman! This just leaves us with @thcipriani's approval and I will merge the patch once that is in.

thcipriani added a comment.Aug 27 2024, 1:44 PM
In T373379#10095785, @ssingh wrote:

Thanks @kzimmerman! This just leaves us with @thcipriani's approval and I will merge the patch once that is in.

Approved! Reason for access to deployment group makes sense for airflow-dags.

ssingh updated the task description. (Show Details)Aug 27 2024, 2:13 PM
gerritbot added a comment.Aug 27 2024, 2:13 PM

Change #1066833 merged by Ssingh:

[operations/puppet@production] admin: add jiawang to deployment group

https://gerrit.wikimedia.org/r/1066833

ssingh closed this task as Resolved.Aug 27 2024, 2:35 PM
ssingh claimed this task.

@jwang: request merged, thanks! Please re-open if there are any issues.

jwang reopened this task as Open.Sep 24 2024, 3:38 AM

@ssingh, My manager (@mpopov ) told me I should request for airflow-analytics-product-admins group, instead of deployment group. deployment granted me wider permissions than I need. Could you remove me from deployment group and add me into airflow-analytics-product-admins group?

I am reopening this ticket since all necessary info has been listed here. Please let me know If I should create a new ticket instead. Thank you.

Maintenance_bot removed a project: Patch-For-Review.Sep 24 2024, 4:30 AM
mpopov renamed this task from Requesting access to deployment group for jiawang to Requesting access to airflow-analytics-product-admins group for jiawang.Sep 24 2024, 2:36 PM
ssingh added a subscriber: jijiki.Sep 24 2024, 2:38 PM

@jwang: Adding the clinic duty person on this week (@jijiki) to take care of this request. Thank you!

mpopov added a comment.Sep 24 2024, 2:39 PM

That is correct – the original request should have been for airflow-analytics-product-admins, similar to T373194: Requesting access to airflow-analytics-product-admins for kcvelaga

As the approver for that group and @jwang's manager I approve the request.

And yes, please undo the deployment group membership.

jijiki added a comment.Sep 26 2024, 11:44 AM

@mpopov @jwang is also present in analytics_privatedata_users , analytics-product-users, shall we remove them from those groups as well?

gerritbot added a comment.Sep 26 2024, 1:14 PM

Change #1075889 had a related patch set uploaded (by Effie Mouzeli; author: Effie Mouzeli):

[operations/puppet@production] admin.yaml: jiawang change groups

https://gerrit.wikimedia.org/r/1075889

gerritbot added a project: Patch-For-Review.Sep 26 2024, 1:14 PM

Change #1075889 merged by Effie Mouzeli:

[operations/puppet@production] admin.yaml: jiawang change groups

https://gerrit.wikimedia.org/r/1075889

Maintenance_bot removed a project: Patch-For-Review.Sep 26 2024, 1:31 PM
mpopov closed this task as Resolved.Sep 26 2024, 4:21 PM

Thank you for updating membership, @jijiki!

In T373379#10178955, @jijiki wrote:

@mpopov @jwang is also present in analytics_privatedata_users , analytics-product-users, shall we remove them from those groups as well?

Nope, those are still very necessary groups for @jwang to remain in.

jwang added a comment.Sep 26 2024, 4:22 PM

is also present in analytics_privatedata_users , analytics-product-users, shall we remove them from those groups as well?

Please keep me in analytics_privatedata_users , analytics-product-users group.

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits