-
Notifications
You must be signed in to change notification settings - Fork 791
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Develop better ACLs for prow build clusters and e2e projects #844
Comments
Spoke with test-infra-oncall team, if I can't add the group they use, I have permission to create a new @kubernetes.io group for them here |
Will work on this over next two weeks |
#919 setup the following:
They're only using primitive roles (owner and viewer) |
k8s-infra-prow-viewers@kubernetes.io is significantly more useful now thanks to the custome |
Revisiting the description
Members of k8s-infra-prow-viewers@kubernetes.io can do this
I question whether it's worth making the distinction between "can access secrets" and "can write to cluster". The more valuable thing would be to build trust and staff k8s-infra-prow-oncall@kubernetes.io. What do others think?
Members of k8s-infra-prow-viewers@kubernetes.io can do this RFC: what else do people think needs to be done to close this out? |
Issues go stale after 90d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
/close |
@spiffxp: Closing this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
At present, I basically copied what was done for the
aaa
cluster and thekubernetes-public
project, and applied that to:There are some problems with this setup:
I'd like to get us to the point where we have something better, possibly:
ref: #752, followup to: #830
The text was updated successfully, but these errors were encountered: