TechPrufer
Get started
Uber
Uber logoUber · Feature trail

Privileged Command Execution Gateway

2 posts · Jun 2025 – Feb 2026

What this trail covers

Uber has introduced the Superuser Gateway, a system designed to provide a safe, auditable, and reviewed path for executing dangerous privileged commands. This system replaces direct superuser access with a workflow involving peer review, automated validation, and controlled remote execution, significantly reducing the risk of accidental data corruption or system outages. Initially targeting data storage systems, the gateway aims to expand to other privileged systems across Uber.

All Uber trails
  1. Superuser Gateway: Guardrails for Privileged Command ExecutionThis post details the implementation of the Superuser Gateway, a system that replaces direct superuser command execution with a reviewed, auditable path for dangerous operations. It introduces a CLI tool for submitting commands, a Git-backed repository for peer review, CI jobs for automated validation (syntax, permissions, impact estimation), and a backend service for remote execution. The system aims to mitigate risks associated with manual superuser actions, particularly in data platform operations, by enforcing peer review and automated checks before execution.
  2. Automating Kerberos Keytab Rotation at UberThis post details the automation of Kerberos keytab rotation at Uber, a critical security credential management task. It describes the integration with Uber's Secret Management Platform (SMP) and the Keytab Distribution Pipeline (KDP) to achieve scalable, automated rotation. The post elaborates on the challenges of keytab rotation at scale, including the risk of service disruption due to kvno mismatches during authentication (AS_REQ and AP_REQ). It outlines the architectural solutions and timeline-based strategies implemented to minimize authentication failures for both client and server-side operations, including strategies like ensuring sufficient TGT validity, minimizing keytab fetch times, and maintaining dual key versions on servers during transition phases. The post also touches upon minimizing blast radius by migrating to node-specific principals/keytabs.