@vaughnwalters is in my sibling team Quality Services. He is created Jenkins job to run end-to-end tests on the Catalyst infrastructure. We did some round of reviews over the week and in the interest of latency we agreed he should be granted the permission to deploy the jobs by himself.

To do so, we need Vaugh account to be added to the ciadmin LDAP group. That is the group used in Jenkins to grant permission to deploy/update jobs. Once the access is granted, I will pair with Vaughn to guide him through the tooling we use to deploy the jobs ( https://www.mediawiki.org/wiki/CI/JJB ).

CC @dduvall who is running my team meetings and as far as I know act as interim manager for accesses approvals.

Event Timeline

hashar created this task.Thu, Jul 30, 2:51 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptThu, Jul 30, 2:51 PM

Jdforrester-WMF awarded a token.Thu, Jul 30, 2:53 PM

Welcome @vaughnwalters

(I wrote something here about an SSH key but please ignore that, I thought this was about shell access at first.)

@dduvall Could you formally approve here?

Other than that I can just do it.

Confirmed Vaughn is already in admin.yaml as ldap_only_admin (and also in wmf LDAP group and WMF/NDA group in Phabicator).

For the step of adding another LDAP group there is no extra group owner like for shell access groups.

But ciadmin is powerful so someone should approve it.

Dzahn changed the task status from Open to In Progress.Thu, Jul 30, 8:52 PM

Mentioned in SAL (#wikimedia-releng) [2026-08-03T16:40:36Z] <hashar> gerrit: added Vaughn Walters to integration group until he get added to the ciadmin LDAP group | T433615

Tyler and Dan are both out this week; CC'ing @Lferreira for potential approval not to have this stuck for too long ideally

Levi, if you don't mind.. and we can just close this out.

It looks like Levi is also out-of-office this week.

We discussed this request in the RelEng weekly meeting 2026-08-05, consensus is that this is appropriate access and should proceed. (For chain-of-responsibility, this includes @dancy who is the current delegate for access requests pertaining to deployment, etc.)

This request has my approval.

Mentioned in SAL (#wikimedia-operations) [2026-08-05T17:12:05Z] <mutante> LDAP - added vwalters to group ciadmin - T433615

thanks all. this is done. I added Vaughn to the ciadmin LDAP group.

@hashar Seeing the shell groups I am wondering if this is also needed here:

deployment-ci-admins: 
  gid: 721     
  description: users who can perform administrative tasks on the deployment servers related to ci/builds.
  members: *contint_admins_members
  privileges: ['ALL = (mwbuilder) NOPASSWD: /usr/local/bin/update-mediawiki-tools-release']

Should a member of LDAP ciadmin also have this?

Grant Access to ciadmin for Vaughn WaltersClosed, ResolvedPublicActions

Description

Event Timeline

Grant Access to ciadmin for Vaughn Walters
Closed, ResolvedPublic
Actions