Requesting permissions for analytics-privatedata-users (with kerberos) for Mareike Heuer
Closed, ResolvedPublicRequest
Actions

Assigned To

Authored By

	MareikeHeuerWMDE
	May 13 2024, 8:41 AM

Description

Requestor provided information and prerequisites

Complete ALL items below as the individual person who is requesting access:

Wikimedia developer account username: mareikeheuer
Email address: mareike.heuer@wikimedia.de
SSH public key (must be a separate key from Wikimedia cloud SSH access): ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHItdDrEyoB+LxAcKWQHfLRiqyzPHnOMKiBkaak5VBMP mareike.heuer@wmde-102987
Requested group membership: analytics-privatedata-users (with kerberos)
Reason for access:
View and develop dashboards in Superset
Run HTML dump scraper script
Perform Hadoop queries
Debug different analytics

Name of approving party (manager for WMF/WMDE staff): @Tobi_WMDE_SW
Ensure you have signed the L3 Wikimedia Server Access Responsibilities document: Signed

SRE Clinic Duty Confirmation Checklist for Access Requests

This checklist should be used on all access requests to ensure that all steps are covered, including expansion to existing access. Please double check the step has been completed before checking it off.

This section is to be confirmed and completed by a member of the SRE team.

- User has signed the L3 Acknowledgement of Wikimedia Server Access Responsibilities Document.
- User has a valid NDA on file with WMF legal. (All WMF Staff/Contractor hiring are covered by NDA. Other users can be validated via the NDA tracking sheet)
- User has provided the following: developer account username, email address, and full reasoning for access (including what commands and/or tasks they expect to perform)
- User has provided a public SSH key. This ssh key pair should only be used for WMF cluster access, and not shared with any other service (this includes not sharing with WMCS access, no shared keys.)
- The provided SSH key has been confirmed out of band
- - and is verified not being used in WMCS.
- access request (or expansion) has sign off of WMDE sponsor/manager (sponsor for volunteers, manager for wmf staff)
- access request (or expansion) has sign off of group approver indicated by the approval field in data.yaml

For additional details regarding access request requirements, please see https://wikitech.wikimedia.org/wiki/Requesting_shell_access

Details

	Subject	Repo	Branch	Lines +/-
	admin: convert mareikeheuer to analytics-privatedata with shell	operations/puppet	production	+11 -5

Customize query in gerrit

Event Timeline

MareikeHeuerWMDE created this task.May 13 2024, 8:41 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 13 2024, 8:41 AM

Tobi please approve and reassign to me, thanks!

In T364715#9791145, @CDanis wrote:

Tobi please approve and reassign to me, thanks!

Thanks for reaching out! I approve that @MareikeHeuerWMDE is in my team and I approve of the request.

Tobi_WMDE_SW reassigned this task from Tobi_WMDE_SW to CDanis.May 15 2024, 1:25 PM

@MareikeHeuerWMDE Could you please send an email to Katie Francis (https://meta.wikimedia.org/wiki/User:KFrancis_(WMF))? She will follow-up with you to get you an NDA and once that is done we can resolve the rest of the ticket here. Best, Daniel

Taking over as this week's clinic duty.

Dzahn triaged this task as High priority.May 20 2024, 8:39 PM

@KFrancis Hi! Mareike is going to need an NDA here for WMDE employees with access to analytics private data. Thank you!

Once the NDA process is finished we can move on with this ticket. Thanks for already singing L3. I'll prepare a needed patch and upload it to code review meanwhile.

Hello @Dzahn The NDA is out for signatures. I'll confirm when it's complete.

Change #1035545 had a related patch set uploaded (by Dzahn; author: Dzahn):

[operations/puppet@production] admin: convert mareikeheuer to analytics-privatedata with shell

https://gerrit.wikimedia.org/r/1035545

gerritbot added a project: Patch-For-Review.May 23 2024, 6:36 PM

Dzahn changed the task status from In Progress to Stalled.May 24 2024, 12:10 AM

stalled waiting for NDA - handing over to next week's clinic duty

Hi all, I'm confirming the NDA has been signed. Please proceed with next steps. Thanks!

colewhite updated the task description. (Show Details)May 28 2024, 10:11 PM

colewhite added a project: Data-Engineering.

Added Data Engineering tag for provisioning of Kerberos.

Pinging one of @odimitrijevic, @Milimetric, @WDoranWMF, @Ahoelzl for Analytics team approval.

colewhite removed colewhite as the assignee of this task.May 31 2024, 9:18 PM

Ladsgroup subscribed.Jun 3 2024, 5:49 PM

In T364715#9840315, @colewhite wrote:

Added Data Engineering tag for provisioning of Kerberos.

That's not needed, adding the kerberos principal (if requested) should be done by the person on SRE clinic duty, see https://wikitech.wikimedia.org/wiki/SRE/Clinic_Duty/Access_requests#Other_groups

Reedy renamed this task from Requesting permissions for analytics-privatedata-users (with kerberos) for Mareike Heuer to Requesting permissions for analytics-privatedata-users (with kerberos) for Mareike Heuer.Jun 5 2024, 7:24 AM

The correct link to the docs for setting up kerberos: https://wikitech.wikimedia.org/wiki/Data_Engineering/Systems/Kerberos/Administration#Create_a_principal_for_a_real_user

lbowmaker moved this task from Incoming (new tickets) to Radar (External Teams) on the Data-Engineering board.Jun 7 2024, 1:08 PM

@lbowmaker Just making sure - this ticket needs an action from Data-Engineering to move forward.

Approved

Change #1035545 merged by Dzahn:

[operations/puppet@production] admin: convert mareikeheuer to analytics-privatedata with shell

https://gerrit.wikimedia.org/r/1035545

Dzahn changed the task status from Stalled to In Progress.Jun 7 2024, 8:29 PM

Dzahn moved this task from Manager/NDA Approval/Confirmation to Patch in Review on the SRE-Access-Requests board.

Maintenance_bot removed a project: Patch-For-Review.Jun 7 2024, 8:30 PM

Dzahn updated the task description. (Show Details)Jun 7 2024, 8:31 PM

Kerberos principal created.

Mareike, you should have received 2 emails, one about changing the password for your Kerberos user and one personal one from me directly.

Dzahn moved this task from Patch in Review to Ready To Go on the SRE-Access-Requests board.Jun 7 2024, 8:55 PM

Resolving as the access looks to have been provisioned, please reopen if any followup is needed. Thanks!

@Dzahn ,
I read your email and also changed my password.
Everything is working as expected.

Thank you

Dzahn awarded a token.Jun 11 2024, 9:00 PM