Page MenuHomePhabricator
Create Task
Maniphest T420691

Automate Wikimedia IDM ("Bitu") and GrowthBook role synchronization
Closed, ResolvedPublic
Actions

Description

This task is for implementation of the Enforcement section of T419622: Verify GrowthBook access approach parts 1-3.

This should be done first for growthbook-next.wikimedia.org to confirm proper function, then for growthbook.wikimedia.org.

This depends on completion of T420690: Create Project in GrowthBook, then migrate materials and access to it and T420688: Create new Wikimedia IDM ("Bitu") LDAP groups for GrowthBook for economy, although technically it would be possible to try it out without the Project first, and then shift it to have the Project confinement notion second.

This is being dropped into Sprint 21 (it will be DP SRE work) for work tracking, but may be dragged into a subsequent sprint.

Details

Other Assignee
brouberol
Related Changes in Gerrit:
Show related patches Customize query in gerrit
Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
growthbook: bump ldap-sync image for drop loggingrepos/data-engineering/airflow-dags!2297ryankemperT420691-mr59-image-bumpmain
ldap-sync: log silently-dropped Bitu membersrepos/data-engineering/growthbook!59ryankemperT420691-silent-drop-loggingmain
growthbook: bump ldap-sync image for elevated fixrepos/data-engineering/airflow-dags!2265ryankemperT420691-bump-ldap-sync-imagemain
ldap-sync: drop secondary POSIX gate for elevatedrepos/data-engineering/growthbook!58ryankemperT420691-elevated-posix-fixmain
test_k8s/growthbook_ldap_sync: fix typo in image tagrepos/data-engineering/airflow-dags!2252brouberolT420691main
Use the global role for admins when computing a plan actionrepos/data-engineering/growthbook!55brouberolT420691main
test_k8s: bump ldap-sync imagerepos/data-engineering/airflow-dags!2247brouberolT420691main
Admin is a global role not a project rolerepos/data-engineering/growthbook!54brouberolT420691main
Add documentation to the growthbook sync dagsrepos/data-engineering/airflow-dags!2246brouberolT420691main
Admins get granted admin role globally and no project rolesrepos/data-engineering/growthbook!53brouberolT420691main
Ensure that admins don't lose their global rolerepos/data-engineering/growthbook!52brouberolT420691main
ldap-sync: make pushgateway job name configurablerepos/data-engineering/growthbook!51ryankemperT420691-pushgateway-jobmain
ldap-sync: add environments to new role entriesrepos/data-engineering/growthbook!50ryankemperT420691-projectroles-environments-fixmain
ldap-sync: fix data_yaml lint and mypy errorsrepos/data-engineering/growthbook!49ryankemperfix-data-yaml-lint-mypymain
Ensure group member lists are flattenedrepos/data-engineering/growthbook!48brouberolT420691main
Install wmf-certificates to be able to call out to internal servicesrepos/data-engineering/growthbook!47brouberolT420691main
Add missing PYTHONPATH environment variablerepos/data-engineering/growthbook!46brouberolT420691main
growthbook: instrument ldap-sync via airflowrepos/data-engineering/airflow-dags!2208ryankemperT420691-ldap-sync-dagmain
ldap-sync: enable ruff&mypy in CI + fix format/importsrepos/data-engineering/growthbook!44ryankemperT420691-lint-typecheckmain
ldap-sync: drop threshold feature & config modulerepos/data-engineering/growthbook!43ryankemperT420691-3.5-trimmain
Show related patches Customize query in GitLab

Related Objects
Search...

Event Timeline

There are a very large number of changes, so older changes are hidden. Show Older Changes
Gehel reassigned this task from brouberol to RKemper.Apr 21 2026, 6:36 PM
Gehel edited projects, added: Data-Platform-SRE (2026-03-27 - 2026-04-17); removed: Data-Platform-SRE.
Gehel moved this task from Backlog - project to In Progress on the Data-Platform-SRE (2026-03-27 - 2026-04-17) board.
CodeReviewBot added a comment.Apr 21 2026, 7:44 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/32

ldap-sync: project scaffolding

CodeReviewBot added a comment.Apr 21 2026, 7:49 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/33

ldap-sync: config, logging, and metrics modules

CodeReviewBot added a comment.Apr 21 2026, 8:07 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/34

ldap-sync: resolver and plan (reconciliation core)

CodeReviewBot added a comment.Apr 21 2026, 8:19 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/35

ldap-sync: data.yaml collector

CodeReviewBot added a comment.Apr 21 2026, 8:21 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/36

ldap-sync: GrowthBook API client

CodeReviewBot added a comment.Apr 21 2026, 8:21 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/37

ldap-sync: LDAP collector

CodeReviewBot added a comment.Apr 21 2026, 8:22 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/38

ldap-sync: GrowthBook member collector and scope filter

CodeReviewBot added a comment.Apr 21 2026, 8:23 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/39

ldap-sync: applier and CLI (full pipeline)

CodeReviewBot added a comment.Apr 21 2026, 9:15 PM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/32

ldap-sync: project scaffolding

CodeReviewBot added a comment.Apr 21 2026, 9:41 PM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/33

ldap-sync: config, logging, and metrics modules

CodeReviewBot added a comment.Apr 21 2026, 10:12 PM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/34

ldap-sync: resolver and plan (reconciliation core)

CodeReviewBot added a comment.Apr 21 2026, 10:27 PM

ryankemper closed https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/31

[WIP] ldap-sync: Scaffold package and reconciliation core

CodeReviewBot added a comment.Apr 22 2026, 3:07 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/40

ldap-sync: add SPEC.md

CodeReviewBot added a comment.Apr 22 2026, 5:45 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/36

ldap-sync: GrowthBook API client

CodeReviewBot added a comment.Apr 22 2026, 6:59 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/41

ldap-sync: fix LDAP_CA_CERT_PATH default to system CA bundle

Gehel edited projects, added: Data-Platform-SRE (2026-04-24 - 2026-05-15); removed: Data-Platform-SRE (2026-03-27 - 2026-04-17).Apr 24 2026, 9:16 AM
Gehel moved this task from Backlog - project to In Progress on the Data-Platform-SRE (2026-04-24 - 2026-05-15) board.
CodeReviewBot added a comment.Apr 24 2026, 9:09 PM

ryankemper closed https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/41

ldap-sync: fix LDAP_CA_CERT_PATH default to system CA bundle

CodeReviewBot added a comment.Apr 25 2026, 2:16 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/42

ldap-sync: GrowthBook API client

CodeReviewBot added a comment.Apr 25 2026, 6:24 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/43

ldap-sync: drop threshold feature & config module

gerritbot added a comment.Apr 29 2026, 4:16 AM

Change #1270558 abandoned by Ryan Kemper:

[operations/deployment-charts@master] growthbook: Bump vendored job templ 1.0.1 → 2.0.0

Reason:

This bug is real but non-exercised, and we're not going the k8s-cronjob route that was going to necessitate it. The bumping vendored job template is worth it down the road, but there's other charts that have the same issue, so it likely warrants doing them all at once

https://gerrit.wikimedia.org/r/1270558

CodeReviewBot added a comment.Apr 29 2026, 6:44 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/43

ldap-sync: drop threshold feature & config module

CodeReviewBot added a comment.Apr 29 2026, 7:01 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/35

ldap-sync: data.yaml collector

CodeReviewBot added a comment.Apr 29 2026, 7:04 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/42

ldap-sync: GrowthBook API client

CodeReviewBot added a comment.Apr 29 2026, 7:05 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/37

ldap-sync: LDAP collector

CodeReviewBot added a comment.Apr 29 2026, 7:07 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/38

ldap-sync: GrowthBook member collector and scope filter

CodeReviewBot added a comment.Apr 29 2026, 8:17 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/39

ldap-sync: applier and CLI (full pipeline)

CodeReviewBot added a comment.Apr 29 2026, 8:19 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/40

ldap-sync: add README.md

Maintenance_bot removed a project: Patch-For-Review.Apr 29 2026, 8:31 AM
CodeReviewBot added a project: Patch-For-Review.Apr 30 2026, 6:10 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/44

ldap-sync: enable ruff&mypy in CI + fix format/imports

CodeReviewBot added a comment.May 5 2026, 7:58 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2208

growthbook: instrument ldap-sync via airflow

CodeReviewBot added a comment.May 8 2026, 4:44 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/44

ldap-sync: enable ruff&mypy in CI + fix format/imports

RKemper added a comment.May 8 2026, 4:57 AM

Haven't posted here in awhile. Current state: the actual ldap-sync script is fully done (which was the bulk of the work).

Airflow deployment ongoing. We have patch 1 ready now which sets up the initial DAG skeleton and some basic validation testing. I tested it with airflow-devenv, and verified it's working; I attached a log at the end of this comment

Steps remaining

Remaining steps AFAIK until this project is more-or-less wrapped:

  1. Patch 2a (deployment-charts): chart changes
  2. Patch 2b (private puppet): add the API key value (already exists in private puppet under the growthbook chart's namespace, where the GB backend reads it; need to duplicate under the airflow-test-k8s namespace so the DAG's task pod can read it too)
  3. helmfile apply on airflow-test-k8s -> Secret gets the key
  4. Patch 2c (airflow-dags, one-line): pin IMAGE tag
  5. Trigger DAG manually via Airflow UI to test
  6. Patch 3 (airflow-dags, one-line): flip schedule=None -> "*/30 * * * *"
airflow-devenv log

Validated the secret-name resolution end-to-end via airflow-devenv

Spun up a dev instance; the DAG-serialization step succeeded, confirming the scheduler imports the DAG cleanly (no KeyError on os.environ["SERVICE_IDENTIFIER"]):

$ airflow-devenv create --branch T420691-ldap-sync-dag --dags-folder test_k8s
- Creating PG database dev_ryankemper ✅
- Installing airflow dev environment dev-ryankemper ✅
- Waiting for the kerberos pod to start ✅
- Kerberos credentials successfully setup ✅
- Waiting for the scheduler pod to be ready ✅
- Forcing DAG serialization ✅
- Waiting for the webserver pod to be ready ✅

Confirmed SERVICE_IDENTIFIER resolves to the per-instance value via the chart's app.airflow.env helper, and the matching <SERVICE_IDENTIFIER>-secret-config Secret exists in the namespace:

$ kubectl -n airflow-dev exec airflow-dev-ryankemper-scheduler-6b76b64bb8-p7s6t -- printenv SERVICE_IDENTIFIER
airflow-dev-ryankemper

$ kubectl -n airflow-dev get secrets | grep ryankemper
airflow-dev-ryankemper-secret-config           Opaque    2    11m

Inspected the DAG's serialized operator: the secretKeyRef.name resolves to <SERVICE_IDENTIFIER>-secret-config, matching the pattern the chart already uses for its own internal keys:

$ kubectl -n airflow-dev exec airflow-dev-ryankemper-scheduler-6b76b64bb8-p7s6t -- \
    python3 -c 'import json; from kubernetes.client import ApiClient; from airflow.models import DagBag; dag = DagBag().get_dag("growthbook_ldap_sync"); print(json.dumps(ApiClient().sanitize_for_serialization(dag.get_task("sync").env_vars), indent=2))'
[
  {
    "name": "GROWTHBOOK_LDAP_SYNC_API_KEY",
    "valueFrom": {
      "secretKeyRef": {
        "key": "GROWTHBOOK_LDAP_SYNC_API_KEY",
        "name": "airflow-dev-ryankemper-secret-config"
      }
    }
  },
  ...
]

Note the actual GROWTHBOOK_LDAP_SYNC_API_KEY key isn't in the Secret yet, that's ongoing work

gerritbot added a comment.May 13 2026, 7:19 AM

Change #1286748 had a related patch set uploaded (by Ryan Kemper; author: Ryan Kemper):

[operations/puppet@production] global_config: add ldap-sync external services

https://gerrit.wikimedia.org/r/1286748

gerritbot added a comment.May 13 2026, 7:25 AM

Change #1286750 had a related patch set uploaded (by Ryan Kemper; author: Ryan Kemper):

[operations/deployment-charts@master] airflow-test-k8s: add ldap-sync task-pod egress

https://gerrit.wikimedia.org/r/1286750

CodeReviewBot added a comment.May 18 2026, 11:28 AM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/46

Add missing PYTHONPATH environment variable

CodeReviewBot added a comment.May 18 2026, 12:11 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/46

Add missing PYTHONPATH environment variable

brouberol updated Other Assignee, added: brouberol; removed: RKemper.May 18 2026, 12:15 PM
CodeReviewBot added a comment.May 18 2026, 12:34 PM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/47

Install wmf-ca-certificates to be able to call out to internal services

CodeReviewBot added a comment.May 18 2026, 12:39 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/47

Install wmf-certificates to be able to call out to internal services

gerritbot added a comment.May 18 2026, 1:21 PM

Change #1288855 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] global_config: add ldap-ro-{eqiad,codfw} to external-services

https://gerrit.wikimedia.org/r/1288855

gerritbot added a comment.May 18 2026, 1:22 PM

Change #1288856 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] airflow-test-k8s: add the ldap-ro task pod external services policy

https://gerrit.wikimedia.org/r/1288856

gerritbot added a comment.May 18 2026, 1:31 PM

Change #1288855 merged by Brouberol:

[operations/puppet@production] global_config: add ldap-ro-{eqiad,codfw} to external-services

https://gerrit.wikimedia.org/r/1288855

gerritbot added a comment.May 18 2026, 1:44 PM

Change #1288856 merged by Brouberol:

[operations/deployment-charts@master] airflow-test-k8s: add the ldap-ro task pod external services policy

https://gerrit.wikimedia.org/r/1288856

gerritbot added a comment.May 18 2026, 1:55 PM

Change #1288864 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] global_config: add gerrit.w.o to external-services

https://gerrit.wikimedia.org/r/1288864

gerritbot added a comment.May 18 2026, 1:56 PM

Change #1288865 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] airflow-test-k8s: add the gerrit task pod external services policy

https://gerrit.wikimedia.org/r/1288865

gerritbot added a comment.May 18 2026, 2:13 PM

Change #1288864 merged by Brouberol:

[operations/puppet@production] global_config: add gerrit.w.o to external-services

https://gerrit.wikimedia.org/r/1288864

gerritbot added a comment.May 18 2026, 2:13 PM

Change #1288865 merged by Brouberol:

[operations/deployment-charts@master] airflow-test-k8s: add the gerrit task pod external services policy

https://gerrit.wikimedia.org/r/1288865

CodeReviewBot added a comment.May 18 2026, 2:46 PM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/48

Ensure group member lists are flattened

CodeReviewBot added a comment.May 18 2026, 2:49 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/48

Ensure group member lists are flattened

gerritbot added a comment.May 18 2026, 3:05 PM

Change #1288894 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/deployment-charts@master] airflow-test-k8s: add the prometheus-pushgateway task pod external services policy

https://gerrit.wikimedia.org/r/1288894

gerritbot added a comment.May 18 2026, 3:09 PM

Change #1288894 merged by Brouberol:

[operations/deployment-charts@master] airflow-test-k8s: add the prometheus-pushgateway task pod external services policy

https://gerrit.wikimedia.org/r/1288894

CodeReviewBot added a comment.May 18 2026, 9:37 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/49

[WI{P] ldap-sync: fix data_yaml lint and mypy errors

CodeReviewBot added a comment.May 18 2026, 10:17 PM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/49

ldap-sync: fix data_yaml lint and mypy errors

CodeReviewBot added a comment.May 19 2026, 1:16 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/50

ldap-sync: add environments to new role entries

CodeReviewBot added a comment.May 19 2026, 1:21 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/51

ldap-sync: make pushgateway job name configurable

CodeReviewBot added a comment.May 19 2026, 1:57 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/50

ldap-sync: add environments to new role entries

CodeReviewBot added a comment.May 19 2026, 2:35 AM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/51

ldap-sync: make pushgateway job name configurable

CodeReviewBot added a comment.May 19 2026, 6:59 AM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/52

Ensure that admins don't lose their global role

CodeReviewBot added a comment.May 19 2026, 7:21 AM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/52

Ensure that admins don't lose their global role

CodeReviewBot added a comment.May 19 2026, 2:51 PM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/53

Admins get granted admin role globally and no project roles

CodeReviewBot added a comment.May 19 2026, 3:01 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/53

Admins get granted admin role globally and no project roles

brouberol added a comment.May 19 2026, 3:50 PM

After talking with @dr0ptp4kt and @mpopov, we decided to

  • only allow members of growthbook-admin, growthbook-customelevatedaccess or growthbook-readonly to be able to SSO-login to growthbook
  • delete all growthbook users (which will move them to orphaned users)
  • re-run the script to only restore the users that require access in the first place

This will ensure that users that were auto-created before we automated user management get orphaned and don't take a seat while being un-used.,

gerritbot added a comment.May 19 2026, 3:56 PM

Change #1289384 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] idp: restrict growthbook UI login to users belonging to the growthbook LDAP groups

https://gerrit.wikimedia.org/r/1289384

gerritbot added a comment.May 20 2026, 7:15 AM

Change #1289384 merged by Brouberol:

[operations/puppet@production] idp: restrict growthbook UI login to the growthbook LDAP groups

https://gerrit.wikimedia.org/r/1289384

gerritbot added a comment.May 20 2026, 7:22 AM

Change #1289752 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] idp: restrict growthbook-next UI login to users in the growthbook LDAP groups

https://gerrit.wikimedia.org/r/1289752

gerritbot added a comment.May 20 2026, 7:45 AM

Change #1289752 merged by Brouberol:

[operations/puppet@production] idp: restrict growthbook-next UI login to users in the growthbook LDAP groups

https://gerrit.wikimedia.org/r/1289752

CodeReviewBot added a comment.May 22 2026, 12:05 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2208

growthbook: instrument ldap-sync via airflow

CodeReviewBot added a comment.May 22 2026, 12:16 PM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2246

Add documentation to the growthbook sync dags

gerritbot added a comment.May 22 2026, 12:30 PM

Change #1291975 had a related patch set uploaded (by Brouberol; author: Brouberol):

[operations/puppet@production] idp/idp_test: temporarily rollback growthbook(-next) access to nda/wmf

https://gerrit.wikimedia.org/r/1291975

gerritbot added a comment.May 22 2026, 12:31 PM

Change #1291975 merged by Brouberol:

[operations/puppet@production] idp/idp_test: temporarily rollback growthbook(-next) access to nda/wmf

https://gerrit.wikimedia.org/r/1291975

CodeReviewBot added a comment.May 22 2026, 12:32 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2246

Add documentation to the growthbook sync dags

CodeReviewBot added a comment.May 22 2026, 1:51 PM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/54

Admin is a global role not a project role

CodeReviewBot added a comment.May 22 2026, 1:54 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/54

Admin is a global role not a project role

CodeReviewBot added a comment.May 22 2026, 2:02 PM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2247

test_k8s: bump ldap-sync image

CodeReviewBot added a comment.May 22 2026, 2:17 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2247

test_k8s: bump ldap-sync image

CodeReviewBot added a comment.May 26 2026, 9:39 AM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/55

Use the global role for admins when computing a plan action

CodeReviewBot added a comment.May 27 2026, 7:42 AM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/55

Use the global role for admins when computing a plan action

CodeReviewBot added a comment.May 27 2026, 1:29 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2250

test_k8s/growthbook_ldap_sync: enable DAG in production

CodeReviewBot added a comment.May 27 2026, 1:38 PM

brouberol opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2252

test_k8s/growthbook_ldap_sync: fix typo in image tag

CodeReviewBot added a comment.May 27 2026, 1:48 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2252

test_k8s/growthbook_ldap_sync: fix typo in image tag

brouberol added a comment.May 27 2026, 2:08 PM

As of now, we have enabled the synchronization of LDAP groups and Growthbook roles for both growthbook-next.w.o and growthbook.w.o. The synchronization is managed by these DAGs.

We have tested the case of orphaning a user, them logging back into growthbok (their user gets assigned a No Access global role as well as no project role). They will then get assigned their "proper" role the next time the DAG runs.

For example, @Gehel had its user orphaned. He logged back into growthbook, and the DAG issued the following log afterwards

{
  "ts": "2026-05-27T14:00:13+0000",
  "level": "INFO",
  "logger": "ldap_sync.applier",
  "actor": "ldap-sync",
  "sync_run_id": "48267a07-55db-4e58-831a-c1af553fc3a7",
  "dry_run": false,
  "message": "action",
  "user_email": "glederrey@wikimedia.org",
  "user_uid": null,
  "growthbook_member_id": "u_6v4betpmlup0ss2",
  "current_role": "NO_ACCESS",
  "target_role": "READ_ONLY",
  "action": "add",
  "action_result": "success",
  "rule_number": 4,
  "source_bitu_groups": [
    "GrowthBook-ReadOnly"
  ],
  "source_posix_groups": [
    "analytics-privatedata-users",
    "deployment"
  ],
  "drift_detected": true
}

I paired with @mpopov to deploy the feature, and we're happy to call this done.

brouberol closed this task as Resolved.May 27 2026, 2:08 PM
brouberol moved this task from In Progress to Done on the Data-Platform-SRE (2026-04-24 - 2026-05-15) board.
Gehel moved this task from Done to Reported on the Data-Platform-SRE (2026-04-24 - 2026-05-15) board.May 29 2026, 7:09 AM
CodeReviewBot added a comment.Jun 2 2026, 7:18 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/58

ldap-sync: drop secondary POSIX gate for elevated

CodeReviewBot added a comment.Jun 2 2026, 8:31 PM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/58

ldap-sync: drop secondary POSIX gate for elevated

CodeReviewBot added a comment.Jun 2 2026, 8:40 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2265

growthbook: bump ldap-sync image for elevated fix

CodeReviewBot added a comment.Jun 2 2026, 8:55 PM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2265

growthbook: bump ldap-sync image for elevated fix

CodeReviewBot added a comment.Jun 3 2026, 7:48 PM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/59

ldap-sync: log silently-dropped Bitu members

RKemper added a comment.Jun 9 2026, 5:39 AM

This is live in both production and staging right now. There's one small outstanding patch to improve log clarity.

gerritbot added a comment.Jun 10 2026, 3:50 PM

Change #1286750 abandoned by Ryan Kemper:

[operations/deployment-charts@master] airflow-test-k8s: add ldap-sync task-pod egress

Reason:

superceded by subsequent patches

https://gerrit.wikimedia.org/r/1286750

CodeReviewBot added a comment.Jun 10 2026, 4:04 PM

ryankemper merged https://gitlab.wikimedia.org/repos/data-engineering/growthbook/-/merge_requests/59

ldap-sync: log silently-dropped Bitu members

gerritbot added a comment.Jun 10 2026, 4:16 PM

Change #1286748 abandoned by Ryan Kemper:

[operations/puppet@production] global_config: add ldap-sync external services

Reason:

superseded by 903438182a + be7f33bdc7 (ldap-ro + gerrit egress merged separately); growthbook-api egress turned out unnecessary (internal .discovery.wmnet service)

https://gerrit.wikimedia.org/r/1286748

CodeReviewBot added a comment.Jun 12 2026, 3:38 AM

ryankemper opened https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2297

growthbook: bump ldap-sync image for drop logging

CodeReviewBot added a comment.Jun 15 2026, 1:54 PM

brouberol merged https://gitlab.wikimedia.org/repos/data-engineering/airflow-dags/-/merge_requests/2297

growthbook: bump ldap-sync image for drop logging

Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits