In T434151#12193502, @bd808 wrote:

The last time we did that dance was T392130: upgrade doc hosts to bookworm and the fine folks in Collaboration-Services took care of it.

to collab team: wanted to share it but priority low since it's only about next time a host key changes.

@dduvall Hi! I am going to be out of office until early September but if you have an update here meanwhile that would be great.

@CDiggs-WMF cool! thanks for confirming. it's always the best to end tickets with the user actually verifying. cheers.

@Aklapper being bold. Do you agree?

for the record because I was asked. The title of this doc is Virtualization Evaluation - Private VPS Service Goal.

In T433258#12178332, @IBerker-WMF wrote:

I signed the L3 document, but I don't really need production server access, I need analytics-privatedata-users access. Does that require server access?

thanks all!

@EAlbizzati-WMF gotcha! You already said that on the original ticket, my bad.

regarding the "wmf" group part of your request. This is nowadays a self-service thing.

@dancy This request would also need approval from the group approver for deployment which lists you and Tyler.

@hashar Seeing the shell groups I am wondering if this is also needed here:

oooh! I see now in the ticket body it says "level 2" but in the first comment of @Bethany it then refers to "level 3"! is that what confused us? Is this a request to "level up" from 2 to 3? (cc: @Arnoldokoth @leila )

Thanks as well! We were about to close this ticket out and verify that last open checkbox and then noticed it seems like:

claiming it's resolved - always ok to reopen if there are problems

thanks all!

Thank you so much!

thanks all. this is done. I added Vaughn to the ciadmin LDAP group.

@dancy You are an approver for the contint-users group. Approved?

You can also trust https://config-master.wikimedia.org/known_hosts which lists it. This source is auto-generated.

Sorry, I don't think I can fix this since it's about the puppet-diffs itself, not specific to the jenkins role. afaict.

https://gerrit.wikimedia.org/r/c/operations/puppet/+/1320217

@pwangai Cool! in that case I think the simplest path forward is we just add people to "contint-users" which gives unprivileged shell access to:

Levi, if you don't mind.. and we can just close this out.

In T240266#12152251, @Bawolff wrote:

The announcement email kind of directs users here. They are naturally curious when they click on a link and its all *restricted*

deployed https://gerrit.wikimedia.org/r/c/operations/puppet/+/1320990

I think this is also effectively declined - similar to other tickets about moving repos?

I think this is also effectively declined like similar tasks about moving repos.

temp un-assigning while out on vacation

thanks! VMs created.

I strongly recommend to define the proper solution right now and avoid a diverting "path of least resistence". (Also there is no "just add this user quickly to this host name" fix here).

here are some docs about it:

@elukey ACK, after making that comment I realized there is a difference between "add a member to the group"-approver and "change the sudo rules"-approver. all good either way :)

The change is about editing the permissions of the datacenter-ops shell group.

@CDiggs-WMF The best way to close this ticket would be if you can tell us your access to Matomo works. cheers!

@jijiki Simon uploaded the same change to document their access in data.yaml. So we can consider that a yes. So I abandoned my change but rebased/merged Simon's change. all done!

Other than that I can just do it.

@dduvall Could you formally approve here?

Hi releng team,

Hi there! This is not a super common type access request, so let me start off with some general comments.

Can you please create a new SSH key pair for production access, that is not already used anywhere, and then paste the public part here on the ticket? thanks!

@VRiley-WMF Ok, thanks for the update. Take your time. I will be busy setting up zuul1004 at first regardless. It's ok if you prioritize zuul1006 a bit lower.

:) yay, great to hear

@Arnoldokoth I think you need a fresh scap deployment. There is some config in puppet and some in deployment repo and then scap looks at both and combines them.

@SLyngshede-WMF Should we add contractors with a -ctr wikimedia.org address and an expiry_date to the data.yaml? Or is it not done anymore if they got their group membership via IDM?

In T433417#12171713, @JArguello-WMF wrote:

Where can we get the NDA file to be filled out?

In T433510#12168768, @bd808 wrote:

What is a reasonably test to see if the node is still working as expected?

Today the jenkins package has finally been purged from contint1002/contint2002. So there is no more jenkins on bullseye machines now.