1434168 - Grant the new Buildduty team (6 people) membership of releng and vpn_releng groups

Status: RESOLVED FIXED

(Infrastructure & Operations :: MOC: Service Requests, task)

Description

[Jordan Lund (:jlund)]

+++ This bug was initially created as a clone of Bug #1308470 +++

We have a new Buildduty team who recently started yesterday and need access to our private releng infra.

Here is their names and LDAP info:

  - Cosmin Bontea <[e-mail]>
  - Bogdan Crisan <[e-mail]
  - Danut Labici <[e-mail]>
  - Radu Iman <[e-mail]>
  - Roland Mutter <[e-mail]>
  - Zsolt Fay - <[e-mail]>

Please add the following groups for each of them:

cn=releng,ou=groups,dc=mozilla
cn=RelEngWiki,ou=groups,dc=mozilla
cn=vpn_releng,ou=groups,dc=mozilla
cn=vpn_releng_loan,ou=groups,dc=mozilla
cn=vpn_releng_self_serve,ou=groups,dc=mozilla
cn=vpn_relengwiki,ou=groups,dc=mozilla

I can vouch for them.

Comment 1

[Linear Ni-Ya Li [:nli]]

All granted with needed ldap permission. (In reply to Jordan Lund (:jlund) from comment #0)
> +++ This bug was initially created as a clone of Bug #1308470 +++
> 
> We have a new Buildduty team who recently started yesterday and need access
> to our private releng infra.
> 
> Here is their names and LDAP info:
> 
>   - Cosmin Bontea <[e-mail]>
>   - Bogdan Crisan <[e-mail]
>   - Danut Labici <[e-mail]>
>   - Radu Iman <[e-mail]>
>   - Roland Mutter <[e-mail]>
>   - Zsolt Fay - <[e-mail]>
> 
> Please add the following groups for each of them:
> 
> cn=releng,ou=groups,dc=mozilla
> cn=RelEngWiki,ou=groups,dc=mozilla
> cn=vpn_releng,ou=groups,dc=mozilla
> cn=vpn_releng_loan,ou=groups,dc=mozilla
> cn=vpn_releng_self_serve,ou=groups,dc=mozilla
> cn=vpn_relengwiki,ou=groups,dc=mozilla
> 
> I can vouch for them.


All granted with needed ldap permissions expect for cn=vpn_releng_self_serve not seen in ldap. 

Thank you.

Comment 2

[Jordan Lund (:jlund)]

Thank You!

Turns out they need a few more groups for various systems. I've updated our docs so we can do this all at once next time: https://wiki.mozilla.org/Buildduty/day_1_checklist#Buildduty_LDAP_groups


For loaning  we need(at least according to Bug 1337793):
cn=vpn_tooltooleditor,ou=groups,dc=mozilla

For nagios:
cn=nagiosadmin,ou=groups,dc=mozilla

For inventory:
cn=inventory_build,ou=groups,dc=mozilla
cn=vpn_inventory,ou=groups,dc=mozilla


Also, this may be an old obsolete group too but just in case: 
cn=buildteam,ou=groups,dc=mozilla


needinfo kendall - probably worth having Kendall sign off on the inventory group. I'm not sure if Buildduty had this last time and it gives them access to relops machines.

Comment 3

[Jordan Lund (:jlund)]

(In reply to Jordan Lund (:jlund) from comment #2)

> 
> For loaning  we need(at least according to Bug 1337793):
> cn=vpn_tooltooleditor,ou=groups,dc=mozilla

I also saw this comment: https://bugzilla.mozilla.org/show_bug.cgi?id=1267537#c12

If this represents a group that I have not listed, we will need that too.

Comment 4

[Linear Ni-Ya Li [:nli]]

added
cn=vpn_tooltooleditor,ou=groups,dc=mozilla
cn=nagiosadmin,ou=groups,dc=mozilla
cn=buildteam,ou=groups,dc=mozilla

Also added them to as owners of the group cn=vpn_releng_loan


Waiting green signal for inventory bits.

Comment 5

[Kendall Libby [:fubar] (he/him)]

(In reply to Jordan Lund (:jlund) from comment #2)
>
> needinfo kendall - probably worth having Kendall sign off on the inventory
> group. I'm not sure if Buildduty had this last time and it gives them access
> to relops machines.

r+

Comment 6

[Ludovic Hirlimann [:Usul]]

added to :
cn=inventory_build,ou=groups,dc=mozilla
cn=vpn_inventory,ou=groups,dc=mozilla

Comment 7

[Linear Ni-Ya Li [:nli]]

Thanks Ludo. 

All done.

Comment 8

[Jordan Lund (:jlund)]

Hi,

Unfortunately, another around is needed.

Turns out they still did not have access to Inventory even with `vpn_inventory` and `inventory_build`. They also need `inventory`.


In addition, they also no longer have try/level-1 access which they obtained prior to receiving their ldap accounts in Bug 1423451. I neglected to realize you don't automatically get level 1 access with LDAP. Should I reopen the dep bugs in 1423451 or can you grant them access here?


cn=active_scm_level_1,ou=groups,dc=mozilla
cn=all_scm_level_1,ou=groups,dc=mozilla
cn=inventory,ou=groups,dc=mozilla
cn=GraphsAdmin,ou=groups,dc=mozilla
cn=vpn_genericrhel6,ou=groups,dc=mozilla


I updated our wiki again with latest set: https://wiki.mozilla.org/index.php?title=Buildduty/day_1_checklist&diff=1188564&oldid=1188446

Linear: re: question above ^ with regards to level 1 access groups

Comment 9

[Linear Ni-Ya Li [:nli]]

(In reply to Jordan Lund (:jlund) from comment #8)
> Hi,
> 
> Unfortunately, another around is needed.
> 
> Turns out they still did not have access to Inventory even with
> `vpn_inventory` and `inventory_build`. They also need `inventory`.
> 
> 
> In addition, they also no longer have try/level-1 access which they obtained
> prior to receiving their ldap accounts in Bug 1423451. I neglected to
> realize you don't automatically get level 1 access with LDAP. Should I
> reopen the dep bugs in 1423451 or can you grant them access here?
> 
> 
> cn=active_scm_level_1,ou=groups,dc=mozilla
> cn=all_scm_level_1,ou=groups,dc=mozilla
> cn=inventory,ou=groups,dc=mozilla
> cn=GraphsAdmin,ou=groups,dc=mozilla
> cn=vpn_genericrhel6,ou=groups,dc=mozilla
> 
> 
> I updated our wiki again with latest set:
> https://wiki.mozilla.org/index.php?title=Buildduty/
> day_1_checklist&diff=1188564&oldid=1188446
> 
> Linear: re: question above ^ with regards to level 1 access groups

added to:

cn=active_scm_level_1,ou=groups,dc=mozilla
cn=all_scm_level_1,ou=groups,dc=mozilla
cn=inventory,ou=groups,dc=mozilla
cn=GraphsAdmin,ou=groups,dc=mozilla
cn=vpn_genericrhel6,ou=groups,dc=mozilla

Comment 10

[Jordan Lund (:jlund)]

Thanks for all your work here