Page MenuHomePhabricator

Requesting access to deployment for jdlrobson
Closed, ResolvedPublicRequest

Description

Requestor provided information and prerequisites

Complete ALL items below as the individual person who is requesting access:

  • Wikimedia developer account username: @Jdlrobson
    • (email/key details already present in data.yaml)
  • Requested group membership: deployment
  • Reason for access: Required for spiderpig's 2fa (scap spiderpig-otp)
  • Name of approving party (manager for WMF/WMDE staff):
  • Ensure you have signed the L3 Wikimedia Server Access Responsibilities document:
  • Please coordinate obtaining a comment of approval on this task from the approving party.

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

  • - User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
  • - User has a valid NDA on file with WMF legal. (All WMF Staff/Contractor hiring are covered by NDA. Other users can be validated via the NDA tracking sheet)
  • - User has provided the following: developer account username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
  • - User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not shared with any other service (this includes not sharing with WMCS access, no shared keys.)
  • - The provided SSH key has been confirmed out of band and is verified not being used in WMCS.
  • - access request (or expansion) has sign off of WMF sponsor/manager (sponsor for volunteers, manager for wmf staff)
  • - access request (or expansion) has sign off of group approver indicated by the approval field in data.yaml

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Details

Event Timeline

Eevans updated the task description. (Show Details)
Eevans added a subscriber: Jdlrobson.
Eevans removed a subscriber: Jdlrobson-WMF.

@Jdlrobson-WMF this seems like an odd question after all this time, but have you signed {L3}?

And, while we're in the business of ticking boxes, can you have your manager comment with approval too?

Eevans changed the task status from Open to In Progress.May 8 2025, 8:25 PM
Eevans triaged this task as Medium priority.

For clarity: I filed this task as a followup to a request for spiderpig access. deployment membership is currently required to login to spiderpig.

As @Jdlrobson-WMF 's manager, provided he has filled out the above form I approve this request

@Jdlrobson-WMF this seems like an odd question after all this time, but have you signed L3 Acknowledgement of Wikimedia Server Access Responsibilities ?

I don't think I have. Give me some time to read through it. In particular I want to have some time to check in on my SSH key situation.

While I'm doing that @thcipriani is there any deployment training necessary for people like myself who have never done deployments using the old way? I saw you are doing some kind of deploy party this week but I don't think I'll be able to join that this week.

BCornwall changed the task status from In Progress to Stalled.May 12 2025, 9:46 PM
BCornwall assigned this task to Jdlrobson-WMF.
BCornwall subscribed.

Hi, @Jdlrobson-WMF, could you please sign the L3 doc? Thanks!

@Jdlrobson-WMF this seems like an odd question after all this time, but have you signed L3 Acknowledgement of Wikimedia Server Access Responsibilities ?

I don't think I have. Give me some time to read through it. In particular I want to have some time to check in on my SSH key situation.

While I'm doing that @thcipriani is there any deployment training necessary for people like myself who have never done deployments using the old way? I saw you are doing some kind of deploy party this week but I don't think I'll be able to join that this week.

Glad you were able to sit in with us this week! The goal of spiderpig is that it should enable folks who write code to deploy their own changes just like interacting with a deployer in IRC.

Tips:

  • Stick to deploying during windows defined on the deployment calendar
  • continue to communicate with other deployers in #wikimedia-operations IRC.
  • If a change goes badly (i.e., you make it to test servers and it doesn't look how you expect), create a revert and deploy that.

So exactly like getting a backport deployed, except you can deploy it.

thcipriani changed the task status from Stalled to Open.May 21 2025, 12:10 AM

@Jdlrobson-WMF this seems like an odd question after all this time, but have you signed {L3}?

And, while we're in the business of ticking boxes, can you have your manager comment with approval too?

Noting that @Jdlrobson signed this to get original access to the restricted group.

thcipriani updated the task description. (Show Details)

For clarity, I signed with this account on phab ( @Jdlrobson-WMF )

Screenshot 2025-05-20 at 5.25.30 PM.png (854×2 px, 185 KB)

Dzahn subscribed.

confirmed user has signed L3.

Since the group approver is also the person who created this ticket we can also consider it approved.

Which should make this ready to go.

Change #1149488 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] admin: add jdlrobson to deployment group

https://gerrit.wikimedia.org/r/1149488

Dzahn changed the task status from Open to In Progress.May 22 2025, 9:43 PM

Change #1149488 merged by Arnaudb:

[operations/puppet@production] admin: add jdlrobson to deployment group

https://gerrit.wikimedia.org/r/1149488

Hey @Jdlrobson @Jdlrobson-WMF you have a user on the deployment servers now.

You should now be able to run the scap spiderpig-otp command on them to get the access code which then lets you login to spiderpig to deploy.

Dzahn claimed this task.

feel free to reopen if you run into any issues, cheers!

Thanks all! Looking forward to trying this out next week!