Just checking: does this have any relation with T550: Allow group members to be managed by external service (i.e. ldap)?

Hmmm. Shell access is in some level equivalent to being a member of the bastion project in LDAP, but IIRC there's some more magic happening with wikitech and OpenStack. And AFAIUI, everything's in flow with an upgrade of OpenStack on the horizon. @Andrew, @coren, @yuvipanda, can you please describe what "shell access" in the context of Labs is (and what it will be in the future)?

@Andrew, @coren, @yuvipanda, can you please describe what "shell access" in the context of Labs is (and what it will be in the future)?

Right now it is a manual user right granted that allows you access to the bastion hosts.

I personally am not sure if we need that to be a request - I don't think anyone doesn't get it, and in the cases we've had to remove it from people it's always been after the fact. We can just monitor bastions for resource usage limits and it should be ok (we can even setup cgroups based limits there if we want).

So IMO, 'shell requests' should not exist. They're a waste of user / admin time.

The best process is no process at all, so if this works for the Labs team, it works for me as well. :)

Should we close this in favour of T97334: Grant shell user right with project memberships and remove autocreation of shell requests ?