Requesting access to deployment shell access for Kgraessle
Open, Needs TriagePublicRequest
Actions

Assigned To

None

Authored By

	Kgraessle
	Wed, Nov 6, 4:38 PM

Description

Requestor provided information and prerequisites

Complete ALL items below as the individual person who is requesting access:

Wikimedia developer account username: Kgraessle
Email address: [email protected]
SSH public key (must be a separate key from Wikimedia cloud SSH access): ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMbWErwIys9ui42OUNWNbt3RSG4VN5Kngf2XOc5pm91d katherinegraessle@wmf3485
Requested group membership: deployment
Reason for access: Access to stat machines in production for query load testing
Name of approving party (manager for WMF/WMDE staff): @SCherukuwada
Ensure you have signed the L3 Wikimedia Server Access Responsibilities document: I have
Please coordinate obtaining a comment of approval on this task from the approving party.

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

- User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
- User has a valid NDA on file with WMF legal. (All WMF Staff/Contractor hiring are covered by NDA. Other users can be validated via the NDA tracking sheet)
- User has provided the following: developer account username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
- User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not shared with any other service (this includes not sharing with WMCS access, no shared keys.)
- The provided SSH key has been confirmed out of band and is verified not being used in WMCS.
- access request (or expansion) has sign off of WMF sponsor/manager (sponsor for volunteers, manager for wmf staff)
- access request (or expansion) has sign off of group approver indicated by the approval field in data.yaml

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Event Timeline

Kgraessle created this task.Wed, Nov 6, 4:38 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptWed, Nov 6, 4:38 PM

@thcipriani can you approve this request to join the deployment shell group please?

MatthewVernon updated the task description. (Show Details)Thu, Nov 7, 10:17 AM

MatthewVernon moved this task from Untriaged to Manager/NDA Approval/Confirmation on the SRE-Access-Requests board.

Katherine's manager is on leave, skip-level here approving.

MatthewVernon updated the task description. (Show Details)Thu, Nov 7, 1:56 PM

Reason for access: Access to stat machines in production for query load testing

Does this mean machines like stat1008, stat1009, etc? The deployment group has no access to those machines. analytics-privatedata-users and others do:

- analytics-privatedata-users
- analytics-admins
- gpu-users
# elasticsearch::analytics creates the analytics-search user and group
# that analytics-search-users are allowed to sudo to.  This is used
# for deploying files to HDFS.
- analytics-search-users
- analytics-wmde-users
- analytics-product-users
- deploy-ml-service
- ml-team-admins

Could you clarify for me @Kgraessle and we'll get you the access you need.

MatthewVernon moved this task from Manager/NDA Approval/Confirmation to Awaiting User Input on the SRE-Access-Requests board.Fri, Nov 8, 9:58 AM

In T379173#10300219, @thcipriani wrote:

Reason for access: Access to stat machines in production for query load testing

Does this mean machines like stat1008, stat1009, etc? The deployment group has no access to those machines. analytics-privatedata-users and others do:

Yes, I do mean those machines, so whatever access gets me that should do. The goal I have is to be able to run SQL queries against production data to identify any performance concerns before implementing the queries in code.

- analytics-privatedata-users
- analytics-admins
- gpu-users
# elasticsearch::analytics creates the analytics-search user and group
# that analytics-search-users are allowed to sudo to.  This is used
# for deploying files to HDFS.
- analytics-search-users
- analytics-wmde-users
- analytics-product-users
- deploy-ml-service
- ml-team-admins