| Petr Michalec | 6e6ead4 | 2017-08-01 11:10:46 +0200 | [diff] [blame] | 1 | classes: |
| 2 | - system.linux.system.sudo |
| 3 | # L1 |
| 4 | - system.openssh.server.team.members.aleksandrdobdin |
| 5 | - system.openssh.server.team.members.aleksandrrubtsov |
| 6 | - system.openssh.server.team.members.anatoliineliubin |
| 7 | - system.openssh.server.team.members.antonrodionov |
| 8 | - system.openssh.server.team.members.collinmay |
| 9 | - system.openssh.server.team.members.danilakhmetov |
| 10 | - system.openssh.server.team.members.deniskostriukov |
| 11 | - system.openssh.server.team.members.dmitrygoloshubov |
| 12 | - system.openssh.server.team.members.javierdiaz |
| 13 | - system.openssh.server.team.members.josuepalmerin |
| 14 | - system.openssh.server.team.members.krzysztoffranckowski |
| 15 | - system.openssh.server.team.members.matthewroark |
| 16 | - system.openssh.server.team.members.maximefimov |
| 17 | - system.openssh.server.team.members.mikhailkraynov |
| 18 | - system.openssh.server.team.members.nadezhdakabanova |
| 19 | - system.openssh.server.team.members.renesoto |
| 20 | - system.openssh.server.team.members.rsafonov |
| 21 | - system.openssh.server.team.members.scottmachtmes |
| 22 | - system.openssh.server.team.members.zahedkhurasani |
| 23 | # L2OPS |
| 24 | - system.openssh.server.team.members.aepifanov |
| 25 | - system.openssh.server.team.members.apetrenko |
| 26 | - system.openssh.server.team.members.atarasov |
| 27 | - system.openssh.server.team.members.dklepikov |
| 28 | - system.openssh.server.team.members.dsutyagin |
| 29 | - system.openssh.server.team.members.ekozhemyakin |
| 30 | - system.openssh.server.team.members.enikanorov |
| 31 | - system.openssh.server.team.members.fsoppelsa |
| 32 | - system.openssh.server.team.members.manashkin |
| 33 | - system.openssh.server.team.members.nkondra |
| 34 | - system.openssh.server.team.members.obryndzii |
| 35 | - system.openssh.server.team.members.oliemieshko |
| 36 | - system.openssh.server.team.members.sovsianikov |
| 37 | # L2OPS SRE Team |
| 38 | - system.openssh.server.team.members.cade |
| 39 | - system.openssh.server.team.members.jmosher |
| 40 | - system.openssh.server.team.members.ecantwell |
| 41 | - system.openssh.server.team.members.lmercl |
| 42 | - system.openssh.server.team.members.mrelewicz |
| 43 | - system.openssh.server.team.members.osmola |
| 44 | - system.openssh.server.team.members.pcizinsky |
| 45 | - system.openssh.server.team.members.pmathews |
| 46 | - system.openssh.server.team.members.pmichalec |
| 47 | parameters: |
| 48 | _param: |
| 49 | linux_system_user_sudo: false |
| 50 | linux: |
| 51 | system: |
| 52 | group: |
| 53 | supportl1: |
| 54 | enabled: false |
| 55 | supportl2: |
| 56 | enabled: false |
| 57 | support0: |
| 58 | enabled: true |
| 59 | name: support0 |
| 60 | support1: |
| 61 | enabled: true |
| 62 | name: support1 |
| 63 | addusers: |
| 64 | # L1 |
| 65 | - ${linux:system:users:ardobdin:name} |
| 66 | - ${linux:system:users:arubtsov:name} |
| 67 | - ${linux:system:users:aneliubin:name} |
| 68 | - ${linux:system:users:arodionov:name} |
| 69 | - ${linux:system:users:cmay:name} |
| 70 | - ${linux:system:users:dakhmetov:name} |
| 71 | - ${linux:system:users:dkostriukov:name} |
| 72 | - ${linux:system:users:dgoloshubov:name} |
| 73 | - ${linux:system:users:jdiaz:name} |
| 74 | - ${linux:system:users:jpalmerin:name} |
| 75 | - ${linux:system:users:kfranckowski:name} |
| 76 | - ${linux:system:users:mroark:name} |
| 77 | - ${linux:system:users:mefimov:name} |
| 78 | - ${linux:system:users:mkraynov:name} |
| 79 | - ${linux:system:users:nkabanova:name} |
| 80 | - ${linux:system:users:rsoto:name} |
| 81 | - ${linux:system:users:rsafonov:name} |
| 82 | - ${linux:system:users:smachtmes:name} |
| 83 | - ${linux:system:users:zkhurasani:name} |
| 84 | support2: |
| 85 | enabled: true |
| 86 | name: support2 |
| 87 | addusers: |
| 88 | # L2OPS |
| 89 | - ${linux:system:users:aepifanov:name} |
| 90 | - ${linux:system:users:apetrenko:name} |
| 91 | - ${linux:system:users:atarasov:name} |
| 92 | - ${linux:system:users:dklepikov:name} |
| 93 | - ${linux:system:users:dsutyagin:name} |
| 94 | - ${linux:system:users:ekozhemyaki:name} |
| 95 | - ${linux:system:users:enikanorov:name} |
| 96 | - ${linux:system:users:fsoppelsa:name} |
| 97 | - ${linux:system:users:manashkin:name} |
| 98 | - ${linux:system:users:nkondra:name} |
| 99 | - ${linux:system:users:obryndzii:name} |
| 100 | - ${linux:system:users:oliemieshko:name} |
| 101 | - ${linux:system:users:sovsianikov:name} |
| 102 | # L2OPS SRE |
| 103 | - ${linux:system:users:pmichalec:name} |
| 104 | - ${linux:system:users:pmathews:name} |
| 105 | - ${linux:system:users:pcizinsky:name} |
| 106 | - ${linux:system:users:osmola:name} |
| 107 | - ${linux:system:users:cade:name} |
| 108 | - ${linux:system:users:jmosher:name} |
| 109 | - ${linux:system:users:ecantwell:name} |
| 110 | - ${linux:system:users:lmercl:name} |
| 111 | - ${linux:system:users:mrelewicz:name} |
| 112 | support3: |
| 113 | enabled: false |
| 114 | name: support3 |
| 115 | addusers: |
| 116 | - ${linux:system:users:pmichalec:name} |
| 117 | - ${linux:system:users:pmathews:name} |
| 118 | - ${linux:system:users:pcizinsky:name} |
| 119 | - ${linux:system:users:osmola:name} |
| 120 | - ${linux:system:users:cade:name} |
| 121 | - ${linux:system:users:jmosher:name} |
| 122 | - ${linux:system:users:ecantwell:name} |
| 123 | - ${linux:system:users:lmercl:name} |
| 124 | - ${linux:system:users:mrelewicz:name} |
| 125 | sudo: |
| 126 | enabled: true |
| 127 | aliases: |
| 128 | command: |
| 129 | SUPPORT_SALT: ${_param:sudo_salt_safe} |
| 130 | SUPPORT_SALT_TRUSTED: ${_param:sudo_salt_trusted} |
| 131 | SUPPORT_RESTRICTED_SHELLS: ${_param:sudo_shells} |
| 132 | SUPPORT_RESTRICTED_SU: ${_param:sudo_restricted_su} |
| 133 | SUPPORT_COREUTILS: ${_param:sudo_coreutils_safe} |
| 134 | SUPPORT_RABBITMQ: ${_param:sudo_rabbitmq_safe} |
| 135 | SUPPORT_SALT_TRUSTED: ${_param:sudo_salt_trusted} |
| 136 | SUPPORT_NETWORKING: ${_param:sudo_networking} |
| 137 | SUPPORT_CONTRAIL: ${_param:sudo_contrail_utilities} |
| 138 | SUPPORT_STORAGE: ${_param:sudo_storage_utilities} |
| 139 | SUPPORT_OPENSTACK_CLIENTS: ${_param:sudo_openstack_clients} |
| 140 | groups: |
| 141 | support0: |
| 142 | # This group should have only RO access to non-sensitive data and commands |
| 143 | # assumed usage: common operations, non experienced, non technical users. |
| 144 | commands: |
| 145 | - SUPPORT_SALT |
| 146 | - '!SUPPORT_RESTRICTED_SHELLS' |
| 147 | - '!SUPPORT_RESTRICTED_SU' |
| 148 | support1: |
| 149 | # This group should have access to safe, trusted, commands |
| 150 | commands: |
| 151 | - SUPPORT_SALT |
| 152 | - SUPPORT_COREUTILS |
| 153 | - SUPPORT_RABBITMQ |
| 154 | - SUPPORT_NETWORKING |
| 155 | - SUPPORT_CONTRAIL |
| 156 | - SUPPORT_STORAGE |
| 157 | - SUPPORT_OPENSTACK_CLIENTS |
| 158 | - '!SUPPORT_RESTRICTED_SHELLS' |
| 159 | - '!SUPPORT_RESTRICTED_SU' |
| 160 | support2: |
| 161 | # This group should have access to any command using sudo |
| 162 | commands: |
| 163 | - SUPPORT_SALT |
| 164 | - SUPPORT_SALT_TRUSTED |
| 165 | - SUPPORT_COREUTILS |
| 166 | - SUPPORT_RABBITMQ |
| 167 | - SUPPORT_NETWORKING |
| 168 | - SUPPORT_CONTRAIL |
| 169 | - SUPPORT_STORAGE |
| 170 | - SUPPORT_OPENSTACK_CLIENTS |
| 171 | - '!SUPPORT_RESTRICTED_SHELLS' |
| 172 | - '!SUPPORT_RESTRICTED_SU' |
| 173 | support3: |
| 174 | # It's never safe to run unlimited number of commands with sudo. |
| 175 | # Use with caution. |
| 176 | commands: |
| 177 | - ALL |
| 178 | - '!SUPPORT_RESTRICTED_SHELLS' |
| 179 | - '!SUPPORT_RESTRICTED_SU' |