Re: [tor-bugs] #30881 [Internal Services/Tor Sysadmin Team]: answer the opsreportcard questionnaire, AKA the "limoncelli test"

["Tor Bug Tracker & Wiki" <blackhole@xxxxxxxxxxxxxx>]

#30881: answer the opsreportcard questionnaire, AKA the "limoncelli test"
-------------------------------------------------+-------------------------
 Reporter:  anarcat                              |          Owner:  anarcat
     Type:  task                                 |         Status:
                                                 |  assigned
 Priority:  Medium                               |      Milestone:
Component:  Internal Services/Tor Sysadmin Team  |        Version:
 Severity:  Normal                               |     Resolution:
 Keywords:                                       |  Actual Points:
Parent ID:                                       |         Points:
 Reviewer:                                       |        Sponsor:
-------------------------------------------------+-------------------------

Comment (by anarcat):

 = Section E: Fleet Management Processes

 == 19. Is there a database of all machines?

 http://opsreportcard.com/section/19

 Yes, but it's somewhat spread around LDAP, Puppet and a spreadsheet.
 There's a ticket open to "improve the inventory" (#30273) which aims at
 solving the problem, possibly with the hope of merging everything in a
 single source of truth (most likely Puppet).

 == 20. Is OS installation automated?

 http://opsreportcard.com/section/19

 Somewhat. New installer scripts have been introduced for our various
 platforms and documentation has been established, but there's some work to
 be done to standardize the process further. See #31239.

 == 21. Can you automatically patch software across your entire fleet?

 http://opsreportcard.com/section/21

 We have a semi-automated process: there's a magic command that can be
 launched manually to perform upgrades over all affected machines,
 requiring approving each similar change manually.

 As for this recommendation:

 > When possible, updates should happen silently. If they require a reboot
 or other interruptions, users should have the ability to delay the update.
 However, there should be a limit; maybe 2 weeks. However the deadline
 should be adjustable so that emergency security fixes can happen sooner.

 ... it's not currently done. See #31957 for followup.

 == 22. Do you have a PC refresh policy?

 http://opsreportcard.com/section/22

 > If you don't have a policy about when PC will be replaced, they'll never
 be replaced. [By "PC" I mean the laptop and desktops that people use, not
 the servers.]

 Strangely, I believe this should also apply to servers, which the report
 card seems to assume are already covered.

 In our case, they are not. There was some work in Brussels to establish
 formal processes to manage the lifetime of systems, see #29304. There is
 also work underway to decommission old machines and replace them with
 newer ones. This crosses over the inventory work (#30272) as well.

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30881#comment:5>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online

_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs