746991 - DB ACLs for new cruncher

Status: RESOLVED FIXED

(Data & BI Services Team :: DB: MySQL, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

Cruncher is moving.  Bye cruncher!

The old cruncher is 10.2.71.143.  The new cruncher is 10.26.48.43.

Please replicate all usernames for 10.2.71.143 for 10.26.48.43 on
 b1
 stage
 buildbot
 bouncer

Thanks!

Comment 1

[Sheeri Cabral [:sheeri]]

Looks like the only matches, including hosts with wildcards, on b1, are:

| buildbot_reader  | 10.2.71.143   |
| buildslaves      | 10.2.71.143   |
| regressdetect    | 10.2.71.143   |


GRANT CREATE TEMPORARY TABLES, SELECT ON `buildbot_schedulers`.* TO 'buildbot_reader'@'10.26.48.43' IDENTIFIED BY PASSWORD 'HASH ELIDED';

GRANT CREATE TEMPORARY TABLES, SELECT ON `buildbot`.* TO 'buildbot_reader'@'10.26.48.43' IDENTIFIED BY PASSWORD 'HASH ELIDED';

GRANT ALTER, ALTER ROUTINE, CREATE, CREATE ROUTINE, CREATE TEMPORARY TABLES, CREATE VIEW, DELETE, DROP, EXECUTE, INDEX, INSERT, LOCK TABLES, REFERENCES, SELECT, SHOW VIEW, UPDATE ON `buildslaves`.* TO 'buildslaves'@'10.26.48.43' IDENTIFIED BY PASSWORD 'HASH ELIDED';

GRANT CREATE TEMPORARY TABLES, SELECT ON `graphs_mozilla_org_new`.* TO 'regressdetect'@'10.26.48.43' IDENTIFIED BY PASSWORD 'HASH ELIDED';

b1 also hosts the buildbot db, so left to check are:

stage
bouncer

Comment 2

[Sheeri Cabral [:sheeri]]

On stage, matches are:

| pptdsh   | 10.%        | 
| test     | 10.%        | 
| buildbot | 10.2.71.143 | 

since the new machine is in the 10.% category, I only have to give perms to the buildbot user:

GRANT SELECT, CREATE TEMPORARY TABLES ON `scheduler_staging`.* TO 'buildbot'@'10.26.48.43' IDENTIFIED BY PASSWORD 'HASH ELIDED';

GRANT SELECT, CREATE TEMPORARY TABLES ON `buildbot_staging`.* TO 'buildbot'@'10.26.48.43' IDENTIFIED BY PASSWORD 'HASH ELIDED';

These have been done.

Left to check:

bouncer

Comment 3

[Sheeri Cabral [:sheeri]]

On bouncer, there's only 1 match:

| cruncher     | 10.2.71.143 | 


GRANT SELECT, EXECUTE ON `bouncer`.* TO 'cruncher'@'10.26.48.43' IDENTIFIED BY PASSWORD 'HASH ELIDED';
 

This has been done.

I'll note that the bouncer db is still being used in sjc, but there is no need for this (tm-bouncer01-master01 is the hostname, not sure what the VIP is). Can you check the application(s) and see if it's directly using tm-bouncer01-master01? There's no need, because there's tp-bouncer01-master01 in phoenix (and corresponding slaves) so it's ready to use phoenix machines whenever you're ready.

But that's for another bug. Marking this one resolved, re-open if there's a problem.