1141308 - Please give [e-mail] access to ship-it.mozilla.org

Status: RESOLVED FIXED

(Infrastructure & Operations :: Corporate VPN: ACL requests, task)

Description

[Wayne Mery (:wsmwk)]

Need access to vpn, ship-it and other infra for building and shipping Thunderbird.

Comment 1

[Wayne Mery (:wsmwk)]

I'll also need instructions on how to connect. Thanks.

Comment 2

[Benjamin Kerensa [:bkerensa]]

This will probably need some weigh in from Release Management Team

Comment 3

[[e-mail] (:bhearsum)]

Ship It has no concept of ACLs to prevent people from starting releases they shouldn't be able to. Without that, or a separate ship it instance, I don't think we can move forward here.

Comment 4

[Wayne Mery (:wsmwk)]

(In reply to Ben Hearsum [:bhearsum] from comment #3)
> Ship It has no concept of ACLs to prevent people from starting releases they
> shouldn't be able to. Without that, or a separate ship it instance, I don't
> think we can move forward here.

Thanks for the update.
I'm confused. I thought there already have non-mozilla employees using these tools. 
If that is not the case, what do you suggest as next step?

Comment 5

[[e-mail] (:bhearsum)]

(In reply to Wayne Mery (:wsmwk) from comment #4)
> (In reply to Ben Hearsum [:bhearsum] from comment #3)
> > Ship It has no concept of ACLs to prevent people from starting releases they
> > shouldn't be able to. Without that, or a separate ship it instance, I don't
> > think we can move forward here.
> 
> Thanks for the update.
> I'm confused. I thought there already have non-mozilla employees using these
> tools.

bkerensa is a non-employee, but he drives Firefox releases.

> If that is not the case, what do you suggest as next step?

What we do here probably depends on whether or not Thunderbird continues to exist on RelEng infra. If it does, we'll need ACLs. If Thunderbird ends up with its own, parallel infra, it will need its own Ship it + release runner instances.

There might be a quick-ish way to hack in ACLs, but I don't have time to dig into at the moment.

Comment 6

[[e-mail] (:bhearsum)]

Worth noting that bug 1140567 is on file about adding roles/permissions to ship it, but it won't be looked in the short term.

Comment 7

[Wayne Mery (:wsmwk)]

Thanks for the info. Much appreciated

Comment 8

[Blake Winton (:bwinton) (:☕️)]

Just spitballing here, but what about trusting Wayne not to ship Firefox while we wait for ACLs/parallel infra?

Comment 9

[Wayne Mery (:wsmwk)]

I didn't think to mention it earlier, but if it helps on the question of trust I've had various mozilla supplied access over the years - login access to crash-stats.com, admin on several mailing lists, sec-bugs in BMO, and more recently the security mailing list.

Comment 10

[Lawrence Mandel [:lmandel] (use needinfo)]

I'm OK giving Wayne access to ship-it in order to manage Thunderbird releases. Blake vouched for him (I asked him in person). We should work on bug 1140567 but I don't think that needs to block us here.

Comment 11

[Ludovic Hirlimann [:Usul]]

(In reply to Blake Winton (:bwinton) from comment #8)
> Just spitballing here, but what about trusting Wayne not to ship Firefox
> while we wait for ACLs/parallel infra?

+1

Comment 12

[Dan Parsons [:lerxst]]

Wayne, do you already have a Mozilla LDAP account? If so, what is it?

Comment 13

[Wayne Mery (:wsmwk)]

(In reply to Dan Parsons [:lerxst] from comment #12)
> Wayne, do you already have a Mozilla LDAP account? If so, what is it?

[e-mail]

Comment 14

[Dan Parsons [:lerxst]]

You are already in the vpn_shipit group. Are you unable to access the server in question?

Comment 15

[Wayne Mery (:wsmwk)]

Attachment: tpad-ipconfig.txt

I am able to login to https://l10n.mozilla.org/ with my ldap user and password.

But on my laptop, connected using viscosity and a mozilla openvpn certificate, I can't get to https://ship-it.mozilla.org/ - "Server not found"

Comment 16

[Dan Parsons [:lerxst]]

What OS and VPN client are you using? Are you able to ping 10.8.81.228 when connected? What about 10.22.75.40?

Comment 17

[Wayne Mery (:wsmwk)]

lerxst fixed me up. thanks #moc