Onboarding build/infra members

[rvagg]

Continuing #2418. Here we figure out how to onboard new people into build/infra since we haven't had to do so for quite some time and a lot of what we do isn't written down. This is for @mmarchini and @richardlau this time around but this can serve as the beginning of documentation so that we can potentially repeat this.

So I'm going to start a list and add to it as I think of things and hopefully other @nodejs/build-infra can add and modify too.

• Add to secrets/build/infra, secrets/build/infra-mac and secrets/build/release
• Add to admin@, accounts@ and build@ in email/iojs.org/aliases.json
• Github nodejs team membership (TODO: someone else can figure out which teams, please)
• Optional but recommended: DigitalOcean team membership (I think our admin_logins.md is wrong, we give access via individual accounts to the team)
• Optional: IBM Cloud team membership
• Optional: Packet.net team membership (we may have to request this if it's needed / wanted)
• Optional: add phone # to Apple root account for 2fa (must be done while in direct contact with someone who has access)
• Discuss relationship with the LF - expenses, helpdesk, other?
• Discuss donor relationships, contacts, limits, sensitivities, deals, etc.
  • DigitalOcean
  • Rackspace
  • MacStadium
  • IBM / Softlayer
  • Microsoft / Azure
  • Scaleway
  • Joyent
  • Cloudflare
  • OSL
  • Intel (not ongoing)
  • Packet.net / ARM
  • nearForm
• Discuss various pieces of infra:
  • Primary www server - lots to discuss, probably need to itemise some of this
  • Backup www server / unencrypted
  • Backup server
  • ci and ci-release - including firewall, disk space management, .. other?
  • nearForm hosted servers (benchmark & Apple)
  • ARM cluster?
  • gh-bot
  • unofficial-builds
• Discuss release pipeline?

[AshCripps]

Theres also the google account holding our cloudflare logs which is infra.

[richardlau]

* [ ]  Github nodejs team membership (TODO: someone else can figure out which teams, please)

build-infra looks to be the obvious team to add myself and @mmarchini to. Once that's done we can run ncu-team on the README here to sync the list.

[rvagg]

@mhdawson || @mmarchini can you take care of the GitHub group access please?

[mmarchini]

Yes. Just build-infra then?

[mmarchini]

Done for build-infra. Let me know if I need to add us on another team.

[rvagg]

Just looking at my groups and here's some others that may be relevant: jenkins-admins and jenkins-release-admins are probably a good idea if you're not there already. automation-admins is another one I'm in but I'm not sure exactly what that does but it says "People who has admin access to automation-related stuff".

[mmarchini]

"automated-related stuff" right now is basically github-bot server I think. Do we need an onboarding for the Jenkins admin teams as well?

[rvagg]

So I think that once you have build/infra, you're better off having maximal access over the top of resources even if you don't end up touching them that much. Managing the ci and ci-release servers is much more practical when you can actually log in as an administrator of Jenkins (primary example: need to update the server, or jenkins itself? you really should put it into "shutting down" mode to stop new jobs). If you limit the scope of your activity to just the things you understand and know how to do then it should be fine.

[rvagg]

But we should probably schedule a follow-up on-boarding and cover anything we feel might be outstanding. I think we said we'd leave that a couple of weeks to let it all settle in and for other questions and concerns to arise out of what you know and can now access. Including Jenkins in a follow-up would be good; we can chat about who "owns" it because that's got become quite confusing over time.

[AshCripps]

@mmarchini whilst you are adding people - would you mind removing the people listed in this #2390 from @nodejs/build please?

[mmarchini]

@AshCripps will do

[github-actions]

This issue is stale because it has been open many days with no activity. It will be closed soon unless the stale label is removed or a comment is made.

[github-actions]

This issue is stale because it has been open many days with no activity. It will be closed soon unless the stale label is removed or a comment is made.