Repository navigation
Access for LF IT to Jenkins instances #3444
Description
Related #3443
Not sure how to materialize this access in Jenkins. Should we create a Github Team for the LF IT and grant them read access? I think that Overall:read will cover all the needs in terms of System, plugins, pipelines, nodes...
Activity
richardlau commentedon Aug 10, 2023
That sounds reasonable.
May need to be extended read to allow viewing of configuration.
richardlau commentedon Aug 10, 2023
I'll note that also adding a new team should also need to update the security matrices in https://github.com/nodejs/build/blob/main/doc/jenkins-guide.md#security-releases for locking/unlocking the CI for security releases.
mhdawson commentedon Oct 3, 2023
@bensternthal which GitHub ids should we provide access to?
bensternthal commentedon Oct 3, 2023
@mhdawson hostmaster+openjs@linuxfoundation.org. CC: @vvalderrv for visibility
vvalderrv commentedon Oct 3, 2023
The GitHub ID is actually thelinuxfoundation
The email address for Jenkins and Cloudflare access is hostmaster+openjs@linuxfoundation.org
mhdawson commentedon Oct 4, 2023
PR to update regular authorization matrix - #3509
I've added the group and thelinuxfoundation to the group LinuxIT-infra-temp, and added to auth matrix with anything that looked like
readenabled.richardlau commentedon Oct 4, 2023
I forget, did we discuss giving this access to both Jenkins or is this just the test CI?
mhdawson commentedon Oct 5, 2023
I think lets start with the public jenkins as that much bigger. I don't think there is too much more that LinuxIT will discover by having read access to the release ci. They can probably just assume it is similar to the test ci but 1/10 the size.
If you think otherwise then we could look at access to the release ci as well.
nschonni commentedon Oct 5, 2023
Probably doesn't matter as a read-only thing, but shouldn't any future write access be granted to actual users, rather than a shared
thelinuxfoundationaccount?mhdawson commentedon Oct 6, 2023
@nschonni using a team is consistent with what we do for other access so I don't think discussion of that suggestion would be specific to linux foundation access.
Access is provided through the group, but individual users are still logged in/authenticated, they just have access because they are part of the GitHub group. I assume that any logging etc is based on the specific user. If you concern was that thelinuxfoundation sounds like a shared account I think that is something we can consider once we figure out the model of how the Foundation will help with the infra.
nschonni commentedon Oct 6, 2023
Probably misunderstanding it, but https://github.com/thelinuxfoundation seems to be a mixed bot+shared credential admin account. Team with actual people sounds like the right approach though
ryanaslett commentedon Oct 24, 2023
Hi there, that github account is the LF's primary account that is used to house ownership of all the subprojects, but its not something we typically use to authenticate (only superadmins have TFA codes etc).
I agree LF admin team would be a good strategy to manage this going forward, can we create that, and start with @vvalderrv and @ryanaslett as the initial members, and grant it read only access to your public jenkins as you have before?
(And you can remove the thelinuxfoundation account access too )
mhdawson commentedon Oct 24, 2023
Ok I removed the original Id, and have sent invites to the two initial members listed.
UlisesGascon commentedon Nov 7, 2023
@ryanaslett @vvalderrv can we close this issue?
vvalderrv commentedon Nov 9, 2023
@UlisesGascon Yes, thank you