Sure, what permissions would you like?

Do you have a list or idea what groups?

TBH I'm not aware of what groups do what, but I would need to be able to test the scripts on this PR on the staging environment.

First i'd need access to batcave to be able to do anything if I'm not mistaken (is that sysadmin-releng?)

scripts/branching-epel/get_all_active_packages_branching.sh needs read access to be able to query directly from /srv/git/rpms

scripts/branching-epel/create_empty_repos.sh needs to be able to write to /pub/ so it can create the repo paths

scripts/branching-epel/make-koji-release-tags needs to be able to query koji, create new tags

We also need to run bodhi releases create.

I added you and @carlwgeorge to sysadmin-releng in staging (note that stg and prod have completely seperate auth clusters. ;)

for batcave (in prod) any sysadmin- group should provide access. I can add you both to sysadmin-releng in prod, but would like to get @jnsamyak 's ack.

scripts/branching-epel/get_all_active_packages_branching.sh needs read access to be able to query directly from /srv/git/rpms

This is on pkgs01? Auth is weird there. I wonder if we couldn't replace this with a playbook?

scripts/branching-epel/create_empty_repos.sh needs to be able to write to /pub/ so it can create the repo paths

I'm not sure this step is needed anymore. I think we just setup ilnks under /mnt/koji/compose/updates/ for the release and that with the new-updates-sync will sync the empty repos to /pub.
I might be missing something here tho.

scripts/branching-epel/make-koji-release-tags needs to be able to query koji, create new tags

That can be done from your local machine (provided you are a koji admin).

We also need to run bodhi releases create.

I'm not sure about this. I think this is the bodhiadmin group. I can add you in staging...

for batcave (in prod) any sysadmin- group should provide access. I can add you both to sysadmin-releng in prod, but would like to get @jnsamyak 's ack.

happy to put my +1 for sysadmin-releng group for both of them, as I checked and working with them it's mainly required for epel mass branching of minor versions.

This is on pkgs01? Auth is weird there. I wonder if we couldn't replace this with a playbook?

Yep it is on pkg machine, or is written to be run under that machine - an option of playbook can be explored tho, not sure about the auth part (a rbac-playbook will work?)

+1 both koji admin and bodhi admin as well, but again happy to run those commands to create tags or creating releases as well, if I have the ticket

for batcave (in prod) any sysadmin- group should provide access. I can add you both to sysadmin-releng in prod, but would like to get @jnsamyak 's ack.

I am already in sysadmin-releng in prod and can ssh into batcave.

That can be done from your local machine (provided you are a koji admin).

I am also a koji admin in prod.

I've added @dherrera to sysadmin-releng in prod.

What all is left here?

@dherrera is there anything missing that you're aware of?

Whatever group allows us to run bodhi releases create and bodhi releases edit. My guess is it's one of these:

• bodhiadmin
• sysadmin-bodhi
• sysadmin-bodhi-admin

It should be 'bodhiadmin' from:

roles/bodhi2/base/templates/production.ini.j2:admin_groups = proventesters security_respons bodhiadmin sysadmin-main bodhi_update_bots

I've added you to the group. Note that you will also now start getting errors from the bodhi web application and possibly other notices. ;)

It didn't work at first, but it did after deleting ~/.config/bodhi/client.json. @dherrera confirmed in chat that it worked for him as well. Thanks!

So we can close this ticket now?

I think so, we can re-open if we realize later we missed something.