1338557 - Please add pmoore public key to authorized_keys file of cltbld/root user of t-yosemite-r7-{0040..0049}

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: CIDuty, task)

Description

[Pete Moore [:pmoore][:pete]]

Attachment: Public ssh key for pmoore

I'm also working on bb->tc OS X worker migration, so will need access to these machines.

Many thanks!

Comment 1

[Pete Moore [:pmoore][:pete]]

Based on https://bugzilla.mozilla.org/show_bug.cgi?id=1298437#c25 is a WONTFIX.

Comment 2

[Pete Moore [:pmoore][:pete]]

It looks like puppet resets password, and authorized_keys for root user, so it looks like it will be best to get me added after all.

I've reduced the range of machines, as in the meantime, 10 machines have been returned to the pool, so this is now just for t-yosemite-r7-{0040..0049}.

Many thanks,
Pete

Comment 3

[Alin Selagea [:aselagea]]

Attachment: bug_1338557.patch

I think this should do it.

Comment 4

[Alin Selagea [:aselagea]]

Comment on attachment 8836729 [details] [diff] [review]
bug_1338557.patch

https://hg.mozilla.org/build/puppet/rev/3e8583e1cd0d
https://hg.mozilla.org/build/puppet/rev/b23ee209ad53

Comment 5

[Alin Selagea [:aselagea]]

These machines will need another puppet run for the changes to be applied.

Comment 6

[Pete Moore [:pmoore][:pete]]

Thanks Alin, Coop!

Comment 7

[Pete Moore [:pmoore][:pete]]

Wander, would you be able to reboot them all for me? Many thanks!

Comment 8

[Wander Lairson Costa]

(In reply to Pete Moore [:pmoore][:pete] from comment #7)
> Wander, would you be able to reboot them all for me? Many thanks!

Done, except by machine 45 that I can't ssh.

Comment 9

[Pete Moore [:pmoore][:pete]]

pmoore@Petes-iMac:~ $ ssh pmoore@t-yosemite-r7-0040
pmoore@t-yosemite-r7-0040's password: 

pmoore@Petes-iMac:~ $ ssh root@t-yosemite-r7-0040
root@t-yosemite-r7-0040's password: 

pmoore@Petes-iMac:~ $ ssh cltbld@t-yosemite-r7-0040
cltbld@t-yosemite-r7-0040's password: 

pmoore@Petes-iMac:~ $ ssh pmoore@t-yosemite-r7-0041
pmoore@t-yosemite-r7-0041's password: 

pmoore@Petes-iMac:~ $ ssh root@t-yosemite-r7-0041
root@t-yosemite-r7-0041's password: 

pmoore@Petes-iMac:~ $ ssh cltbld@t-yosemite-r7-0041
cltbld@t-yosemite-r7-0041's password: 

pmoore@Petes-iMac:~ $ ssh pmoore@t-yosemite-r7-0042
pmoore@t-yosemite-r7-0042's password: 

pmoore@Petes-iMac:~ $ ssh root@t-yosemite-r7-0042
root@t-yosemite-r7-0042's password: 

pmoore@Petes-iMac:~ $ ssh cltbld@t-yosemite-r7-0042
cltbld@t-yosemite-r7-0042's password: 

pmoore@Petes-iMac:~ $ ssh pmoore@t-yosemite-r7-0043
pmoore@t-yosemite-r7-0043's password: 

pmoore@Petes-iMac:~ $ ssh root@t-yosemite-r7-0043
root@t-yosemite-r7-0043's password: 

pmoore@Petes-iMac:~ $ ssh cltbld@t-yosemite-r7-0043
cltbld@t-yosemite-r7-0043's password: 

pmoore@Petes-iMac:~ $ 


Hi Wander, Alin, I couldn't access the machines ^^^ - am I doing something wrong?

Comment 10

[Wander Lairson Costa]

It feels like your key was not added :/

Comment 11

[Alin Selagea [:aselagea]]

For some reason, Pete's public key is not found when running puppet:

Mon Feb 13 13:54:51 -0800 2017 Puppet (err): Could not retrieve catalog from remote server: Error 400 on SERVER: Failed to realize virtual resources Users::Person[pmoore] on node t-yosemite-r7-0041.test.releng.scl3.mozilla.com
Mon Feb 13 13:54:51 -0800 2017 Puppet (err): Could not retrieve catalog; skipping run

I checked the hiera file and the key is present there though.

Comment 12

[Alin Selagea [:aselagea]]

This line seems to be the issue: https://dxr.mozilla.org/build-central/source/puppet/manifests/moco-nodes.pp#15
It looks to me that the old approach to ensure access to a certain person is not valid anymore.

I did some testing by removing that line and noticed the key was properly added to the machine. However, I think we should have a prior verification step here to ensure that the key is actually present in hiera. 
Some suggestions would be much appreciated.

Comment 13

[Wander Lairson Costa]

(In reply to Alin Selagea [:aselagea][:buildduty] from comment #12)
> This line seems to be the issue:
> https://dxr.mozilla.org/build-central/source/puppet/manifests/moco-nodes.
> pp#15
> It looks to me that the old approach to ensure access to a certain person is
> not valid anymore.
> 
> I did some testing by removing that line and noticed the key was properly
> added to the machine. However, I think we should have a prior verification
> step here to ensure that the key is actually present in hiera. 
> Some suggestions would be much appreciated.

How did you add my ssh key?

Comment 14

[Alin Selagea [:aselagea]]

(In reply to Wander Lairson Costa [:wcosta] from comment #13)
> (In reply to Alin Selagea [:aselagea][:buildduty] from comment #12)
> > This line seems to be the issue:
> > https://dxr.mozilla.org/build-central/source/puppet/manifests/moco-nodes.
> > pp#15
> > It looks to me that the old approach to ensure access to a certain person is
> > not valid anymore.
> > 
> > I did some testing by removing that line and noticed the key was properly
> > added to the machine. However, I think we should have a prior verification
> > step here to ensure that the key is actually present in hiera. 
> > Some suggestions would be much appreciated.
> 
> How did you add my ssh key?

Your key was already added in hiera. 
The thing is the "realize" statement resulted in an error which caused the puppet run to fail (and thus, your key could not be added to those machines).

I removed that line and rebooted the machines to force a new puppet run.
https://hg.mozilla.org/build/puppet/rev/64dc854fda8a
https://hg.mozilla.org/build/puppet/rev/5b08e82bcf9d

Checked several machines and your key is now present there, so you should be able to login.
I think we'll still need to figure out a way to make sure the key is actually present in hiera before using it, but that is not a blocker right now.

Comment 15

[Pete Moore [:pmoore][:pete]]

Many thanks Alin! I can access machines now - perfect. :-)

(In reply to Alin Selagea [:aselagea][:buildduty] from comment #14)
> (In reply to Wander Lairson Costa [:wcosta] from comment #13)
> > How did you add my ssh key?
> Your key was already added in hiera. 

Comment 13 was from wcosta not from me... ;)