The sysadmin group used to be a tracking group that all members of any sysadmin-* group were in... the only things it used to give you was ability to commit to the ansible repo and all nagios alert emails. Since ansible is now on pagure it doesn't do that anymore... I think it does still give nagios alerts, but thats it.

So, instead, we should add the specific playbooks you need to run to a existing sysadmin group... like 'sysadmin-releng'

The sysadmin group used to be a tracking group that all members of any sysadmin-* group were in... the only things it used to give you was ability to commit to the ansible repo and all nagios alert emails. Since ansible is now on pagure it doesn't do that anymore... I think it does still give nagios alerts, but thats it.

Got this but it means that i should be in that group at least for tracking purposes that you mentioned.

So, instead, we should add the specific playbooks you need to run to a existing sysadmin group... like 'sysadmin-releng'

The reason of this requests that i needed to run rbac playbook and noticed this https://pagure.io/fedora-infra/ansible/blob/main/f/roles/batcave/tasks/main.yml#_421 it tells that file which defines permissions running rbac is accessible for sysadmin group.

Got this but it means that i should be in that group at least for tracking purposes that you mentioned.
well, I am not sure it makes any sense in the new account system.

The reason of this requests that i needed to run rbac playbook and noticed this https://pagure.io/fedora-infra/ansible/blob/main/f/roles/batcave/tasks/main.yml#_421 it tells that file which defines permissions running rbac is accessible for sysadmin group.

Ah yes, not sure that matters any at all anymore. Probibly should just be root now.

Ah yes, not sure that matters any at all anymore. Probibly should just be root now.

Okay, i can change it if you want, but anyway, can you add me to this group?

ok. I have added you to sysadmin.

That still won't let you run those playbooks though. We will need add them to the rbac config.

What specific playbooks is it? and what group... I assume sysadmin-releng?

I wanted to run manual/move-to-archive.yml playbook and I wanted to add sysadmin-releng to run this playbook, but yeah rbac config is read only ((

[amedvede@batcave01 ~][PROD-RDU3]$ ls -la /etc/ansible_utils/rbac.yaml
-r-xr-----. 1 root sysadmin 14666 Sep 17 17:57 /etc/ansible_utils/rbac.yaml

can you also add me to the sysadmin-noc so I can access pkgs-stg and pagure-stg servers

Well, I can, but it won't allow you ssh access there. ;(

pagure (the software) replaces the ssh auth setup with it's own check (because people use git with ssh) and so it only allows PAGURE_ADMIN_USERS or members of ADMIN_GROUP (I think) in.

So, in order to get you access there we would need to add you to cvsadmin in stg (are you already in there?) and for pagure-stg02 add you to PAGURE_ADMIN_USERS for just staging in roles/pagure/templates/pagure.cfg (if you want to submit a PR that adds a staging conditional there and adds you to staging list?)

Oh, and the move-to-archive playbook isn't going to work with rbac-playbook. ;(
It requires you to pass extra vars which rbac-playbook specifically disallows.

Well, I can, but it won't allow you ssh access there. ;(

pagure (the software) replaces the ssh auth setup with it's own check (because people use git with ssh) and so it only allows PAGURE_ADMIN_USERS or members of ADMIN_GROUP (I think) in.

So, in order to get you access there we would need to add you to cvsadmin in stg (are you already in there?)

Yes, I'm there.

and for pagure-stg02 add you to PAGURE_ADMIN_USERS for just staging in roles/pagure/templates/pagure.cfg (if you want to submit a PR that adds a staging conditional there and adds you to staging list?)

I made a PR for it: https://pagure.io/fedora-infra/ansible/pull-request/3051

Oh, and the move-to-archive playbook isn't going to work with rbac-playbook. ;(
It requires you to pass extra vars which rbac-playbook specifically disallows.

Oh, It's always like that)

The pr just needs rebased now. ;) So, lets close this then?

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/infra/tickets/issues/13013

Please continue any further discussion there.