945762 - please give the vpn_sheriff group access to slaveapi prod & dev instances

Status: RESOLVED FIXED

(Infrastructure & Operations :: Infrastructure: OpenVPN, task)

Description

[[e-mail] (:bhearsum)]

We'd like them to be able to access all current functionality. We may implement some ACLs within slaveapi in the future if we need finer grained access, or maybe something else. For now though, it would be really helpful for them to be able to reboot or shutdown buildslave processes.

Sheriffs, I'll give you a quick run through once this is done - there's still a couple of caveats.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Please add access to slaveapi{-dev,}1.srv.releng.scl3.mozilla.com for the vpn_sheriff group.

Comment 2

[Justin Dow [:jabba]]

Can you give me a list of all IPs that are needed?

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

dmitchell@admin1a ~ $ for f in slaveapi{-dev,}1.srv.releng.scl3.mozilla.com; do host $f; done
slaveapi-dev1.srv.releng.scl3.mozilla.com has address 10.26.48.17
slaveapi1.srv.releng.scl3.mozilla.com has address 10.26.48.16

Comment 4

[Justin Dow [:jabba]]

oh! sorry, I didn't realize that you were already clarifying that in comment 1. Thought there were some other machines plus those in comment 1. Sorry!

This is done now, I added those two IPs.

Comment 5

[Dustin J. Mitchell [:dustin] (he/him)]

No worries.  Explicit is better than implicit (c.f. Zen of Python)