Hashar has uploaded a new change for review. https://gerrit.wikimedia.org/r/99659
Change subject: beta: properly connect to parsoid instance ...................................................................... beta: properly connect to parsoid instance The wmf-beta-autoupdate.py script runs as the mwdeploy user. Thus the ssh commands to the parsoid instance would fail because that user does not have any ssh credential to connect there (jenkins-deploy has). This patch introduce a new tiny shell wrapper to let us execute the parsoid init script on deployment-parsoid2. It must be run as the mwdeploy user (like wmf-beta-autoupdate.py) and will sudo as jenkins-deploy to have the proper credentials. A new sudo policy is added to let mwdeploy execute the shell wrapper as jenkins-deploy. bug: 57233 Change-Id: I0fa1beba0f7e91b0999d6820b20a7569eb735087 --- M files/misc/beta/wmf-beta-autoupdate.py A files/misc/beta/wmf-beta-parsoid-remote.sh M manifests/misc/beta.pp 3 files changed, 39 insertions(+), 12 deletions(-) git pull ssh://gerrit.wikimedia.org:29418/operations/puppet refs/changes/59/99659/1 diff --git a/files/misc/beta/wmf-beta-autoupdate.py b/files/misc/beta/wmf-beta-autoupdate.py index 9acaf8c..d31ed09 100755 --- a/files/misc/beta/wmf-beta-autoupdate.py +++ b/files/misc/beta/wmf-beta-autoupdate.py @@ -20,9 +20,6 @@ PATH_MWCORE = '/home/wikipedia/common/php-master' PATH_MWEXT = '/home/wikipedia/common/php-master/extensions' -# Beta cluster instance used to run Parsoid daemon -PARSOID_INSTANCE = 'deployment-parsoid2.pmtpa.wmflabs' - def main(): """ @@ -147,14 +144,11 @@ def restart_parsoid(): """Restart parsoid daemon via ssh""" logger = logging.getLogger(__name__) - logger.info("restarting parsoid on %s", PARSOID_INSTANCE) + logger.info("restarting parsoid") - parsoid_restart_cmd = [ - 'ssh', PARSOID_INSTANCE, - 'sudo -u root /etc/init.d/parsoid restart'] - logger.info("Executing %s", parsoid_restart_cmd) + parsoid_init_cmd = '/usr/local/bin/wmf-beta-parsoid-remote.sh' try: - cmd = subprocess.Popen(args=parsoid_restart_cmd) + cmd = subprocess.Popen(args=[parsoid_init_cmd, 'restart']) except OSError, exception: logger.error(exception) return False @@ -164,9 +158,7 @@ logger.info('Checking parsoid is running...') try: - cmd = subprocess.Popen([ - 'ssh', PARSOID_INSTANCE, - '/etc/init.d/parsoid', 'status']) + cmd = subprocess.Popen(args=[parsoid_init_cmd, 'status']) status_exit_code = cmd.wait() except OSError, exception: logger.error(exception) diff --git a/files/misc/beta/wmf-beta-parsoid-remote.sh b/files/misc/beta/wmf-beta-parsoid-remote.sh new file mode 100755 index 0000000..921510c --- /dev/null +++ b/files/misc/beta/wmf-beta-parsoid-remote.sh @@ -0,0 +1,21 @@ +#!/bin/bash -x +####################################################################### +# WARNING: this file is managed by Puppet +# puppet:///files/misc/beta/wmf-beta-parsoid-restart.sh +####################################################################### + +if [ "$USER" != 'mwdeploy' ] +then + echo "Script MUST be run as mwdeploy user" + echo "Additionally the user needs sudo right for ssh as jenkins-deploy" + exit 1 +fi + +PARSOID_INSTANCE="deployment-parsoid2.pmtpa.wmflabs" + +# The beta autoupdater runs as mwdeploy. We need jenkins-deploy ssh credentials +# to be able to connect to the parsoid instance. On there, we restart Parsoid +# as root. +sudo -H -u jenkins-deploy \ + ssh $PARSOID_INSTANCE \ + sudo -u root /etc/init.d/parsoid $1 diff --git a/manifests/misc/beta.pp b/manifests/misc/beta.pp index 5655583..ee38fe0 100644 --- a/manifests/misc/beta.pp +++ b/manifests/misc/beta.pp @@ -26,6 +26,15 @@ ensure => absent; } + $beta_parsoid_remote_script = '/usr/local/bin/wmf-beta-parsoid-remote.sh' + + file { $beta_parsoid_remote_script: + ensure => present, + owner => root, + group => root, + mode => 0555, + } + # Make sure wmf-beta-autoupdate can run the l10n updater as l10nupdate sudo_user { "mwdeploy" : privileges => [ 'ALL = (l10nupdate) NOPASSWD:/usr/local/bin/mw-update-l10n', @@ -36,6 +45,11 @@ # it tries to identify as mwdeploy. 'ALL = (mwdeploy) NOPASSWD: ALL', + # The Parsoid restart script needs jenkins-deploy ssh credentials + # to connect to the beta parsoid instance + "ALL = (jenkins-deploy) NOPASSD: $beta_parsoid_remote_script restart", + "ALL = (jenkins-deploy) NOPASSD: $beta_parsoid_remote_script status", + # mergeMessageFileList.php is run by mw-update-l10n as the apache user # since https://gerrit.wikimedia.org/r/#/c/44548/ # Let it runs mwscript and others as apache user. -- To view, visit https://gerrit.wikimedia.org/r/99659 To unsubscribe, visit https://gerrit.wikimedia.org/r/settings Gerrit-MessageType: newchange Gerrit-Change-Id: I0fa1beba0f7e91b0999d6820b20a7569eb735087 Gerrit-PatchSet: 1 Gerrit-Project: operations/puppet Gerrit-Branch: production Gerrit-Owner: Hashar <has...@free.fr> _______________________________________________ MediaWiki-commits mailing list MediaWiki-commits@lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits