Create jenkins-release-admins for ci-release

[gibfahn]

Following discussion on #1107 in the last build meeting (see the minutes), we decided that it would be a good idea to split out admins for ci-release from the existing group, as that way we can be freer with how we give access to ci.

Steps

• Create jenkins-release-admins team and add existing jenkins-admins group
• Give that group admin access to ci-release
• Check that everyone still has access.
• Remove jenkins-admins access from ci-release
• PR to access.md documenting this.

cc/ @maclover7

[juggernaut451]

@gibfahn would like to contribute to this. Could you please mentor me on this

[gibfahn]

@juggernaut451 I'm afraid there's not much you could do here without the right accesses.

[juggernaut451]

@gibfahn could you please give me a minimal access so that I can contribute to it. If not then can you tell me how can I get the right access?

[maclover7]

@gibfahn Would it be possible for you to expedite this ticket -- I am still hanging on for elevated permissions on non-release CI

[rvagg]

OK, so I've done this:

• rename jenkins-admins to jenkins-release-admins
• made a new jenkins-admins with jenkins-release-admins as a "Parent"
• changed ci-release to use jenkins-release-admins
• added @maclover7 to jenkins-admins

I think this gives us what we want. From what I understand, everyone in jenkins-release-admins gets jenkins-admins permissions. It works for me but I'm in both teams cause I made them. Please let me know here if something isn't right.

[mhdawson]

looks like I can still at least select configure for jobs so thinking that means it is ok.

[maclover7]

@rvagg Thank you! I can file a PR updating access.md in the next few days

[refack]

I lost admin access to the public Jenkins. prbly need to rename group in the main roles matrix.

[refack]

Also I think the teams should be flipped since membership is transitive.
so currently:
jenkins-admins = (rvagg + @maclover7)
jenkins-admins-release = (everyone else + (rvagg + @maclover7))

[richardlau]

@refack I think jenkins-admins-release (admins for the release CI) is supposed to be a smaller subset of jenkins-admins (admins for the regular CI).

[refack]

@richardlau I agree, so the current status is flipped.

[gibfahn]

Looks like someone is updating these teams right now, so I'll avoid doing anything.

[rvagg]

I must be daft or something because this inheritance makes no sense to me if it's not working. I made jenkins-admins have a "Parent" of jenkins-release-admins, assuming that it would inherit everyone in jenkins-release-admins and add anyone extra, but apparently that's not how this works?
I've ditched the inheritance and just duplicated members. If someone (with access) groks this and wants to make it inherit properly, then go for it.

[refack]

Well it works for me now 🤷‍♂️

[gibfahn]

I must be daft or something because this inheritance makes no sense to me if it's not working. I made jenkins-admins have a "Parent" of jenkins-release-admins

I think jenkins-admins should be the parent, and jenkins-release-admins should be the child. I'd assume parent teams would contain the sum of their child team's users.