@ABran-WMF Yes, I have no strong feeling about the database name, so what ever fits policy and naming conventions is absolutely fine.

Old Bullseye servers have been decommissioned.

Just to ensure that everyone agrees on what we need. This will be one Ganeti VM, running Bitu, and an LDAP instance.

Logs from idp1002 / idp2002 from 2023 and 2024 have been copied to idp1003 and idp2003 respectively, and are stored in /srv/logs

Bitu is currently installed as a .deb package on two Ganeti hosts.

For somethings I believe it should be fine, the AMD64 "emulation" is pretty good. We did see it struggle on the Puppet CLI container, to the point of it being somewhat painful to use. It boils down to whether or not the thing it runs is somewhat predictable or not. Interpreters aren't fast, but anything that's compiled is mostly workable.

Ranty is good :-)

Enabling of two-factor authentication is planed for after CAS 7 upgrade.

Update be deployed to production with next release.

Will be deployed with the update next Tuesday.

The latest Bookworm tzdata package already have the updated timezone for Kazakhstan as well, maybe we can just backport that one.

That fixed the synchronization with other services, but makes it slightly trigger to actually delete keys.

Okay, I see the issue. In order to not hit LDAP to much, keys are cached, but that's honestly no good as that gives the users a false impression of what keys are active.

@taavi patch has been rolled out on idm-test.wikimedia.org

VM creation: