IaC solution for GitHub

mtupitsyn commented 2 years ago

Abstract

Store most important configuration settings for GitHub teams and repositories in git, and run a periodic task which synchronizes configuration with actual GitHub config via REST API.

Problem Statement

With many people/teams having administration rights on GitHub repositories, it becomes hard to coordinate and monitor changes to repos and teams configuration. With configuration stored in git, we'll have centralized view and clear ownership of each change.

Internal References

CASMINST-3366 - similar requirement for Jenkins
CASMINST-3369 - CTO SCOE requirement which is significantly simplified , if we have IaC solution for GitHub in place.

External References

Proposed Solution(s)

Create a github repo (or consider re-using .github)
Add configuration in YAML. Only partial configuration is required. For example, no need to store repo secrets. Most important settings initially would be: repos config (protected branches, etc), teams membership, assignment of teams to repos.
Add a workflow with scheduled invocation, which updates configuration via REST API. We only need Create/Update, no delete (i.e. we d not delete teams/repos which are not in config)

Note: team which has write permission to IaC repo has write permission to everything else. IaC process must ensure membership of admin group and assignment of only admin group to IaC repo itself.

Impact of Action/Inaction

Relying on current way of configuring repos/teams (through web ui, on per-repository basis) is prone to misconfiguration and complicates audit. Overall this introduces security risk, which is especially critical for public repositories.

Further Information

Infrastructure as Code

Suggested Reviewers

[ ] @denniswalker
[x] @nieuwsma
[x] @rkleinman-hpe
[x] @zcrisler

Comment Period

Comment period for this proposal shall close on Nov 10, 2021.

zcrisler commented 2 years ago

Related to CTO SCOE build assessment requirements CASMINST-3366 and CASMINST-3369.

mtupitsyn commented 2 years ago

Related to CTO SCOE build assessment requirements CASMINST-3366 and CASMINST-3369.

Added these to "Internal References" section.

jsollom-hpe commented 2 years ago

I support this.

Cray-HPE / community