TechPrufer
Sign inGet started

Blogs›Uber›Privileged Command Execution Gateway

Privileged Command Execution Gateway

Privileged Command Execution Gateway

2
posts
2025–2026

Uber has introduced the Superuser Gateway, a system designed to provide a safe, auditable, and reviewed path for executing dangerous privileged commands. This system replaces direct superuser access with a workflow involving peer review, automated validation, and controlled remote execution, significantly reducing the risk of accidental data corruption or system outages. Initially targeting data storage systems, the gateway aims to expand to other privileged systems across Uber. The evolution has involved migrating from direct engineer-held credentials to a centralized gateway service, incorporating a Git-backed PR workflow for review and automated validation jobs for syntax, permissions, and impact estimation. The system now handles hundreds of commands and has successfully migrated all admin engineers to this flow.

2026

Superuser Gateway: Guardrails for Privileged Command Execution

2/26/2026

This post details the architecture and developer experience of the Superuser Gateway. It introduces the CLI tool, Git-backed repository for PRs, CI jobs for automated validation (syntax, permissions, impact estimation), and the backend service for remote execution. It highlights the shift from direct engineer superuser access to a centralized gateway, improving attribution and safety. The post also discusses the trade-offs of peer review latency and the decision to use Git over a database-backed system.

2025

Automating Kerberos Keytab Rotation at Uber

6/18/2025

This post details the automation of Kerberos keytab rotation at Uber, a critical security credential management task. It describes the integration with Uber's Secret Management Platform (SMP) and the Keytab Distribution Pipeline (KDP) to achieve scalable, automated rotation. The post elaborates on the challenges of keytab rotation at scale, including the risk of service disruption due to kvno mismatches during authentication (AS_REQ and AP_REQ). It outlines the architectural solutions and timeline-based strategies implemented to minimize authentication failures for both client and server-side operations, including strategies like ensuring sufficient TGT validity, minimizing keytab fetch times, and maintaining dual key versions on servers during transition phases. The post also touches upon minimizing blast radius by migrating to node-specific principals/keytabs.