Skip to content

RFC: Template owners #2950

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
ammario opened this issue Jul 12, 2022 · 5 comments
Closed

RFC: Template owners #2950

ammario opened this issue Jul 12, 2022 · 5 comments

Comments

@ammario
Copy link
Member

ammario commented Jul 12, 2022

So, there are a lot admins on our dev deployment and a lot of people that can make template changes.

None of our templates are updated automatically in CI—not even the primary dogfood template called "coder". This was an intentional decision by @kylecarbs so we can dogfood in a manner similar to our users.

The coder template can be pulled down by any admin and edited by anyone. There is no built in change management, so it's very easy for two people to run edits on the same template simultaneously and overwrite each other's work. Furthermore, the product doesn't make who you seek template support from clear. There is the "created by" but that is an unchangeable value and will almost certainly fall out of date. In dogfood, I'd bet many don't know that they should ping Kyle and not Dean.

This is especially top of mind for me as I work on a new dogfood template. I don't want anyone other than me editing the template and I want everyone contacting me if they have issues.

Proposal

  • Each template has owners that are users.
  • These owners are listed in replacement of "Created By" on the template pages.
  • The user that creates the template is the first template owner.
  • Only the template owners can make changes to the template, not even the admin. Of course, the admin can add themselves as an owner to make changes.
  • We show the template owner in the build log as well, e.g "Contact X if for workspace support"
  • In mature deployment, the template owner would be the CI machine user

The owners function as both a mutex and support clarity.

@ketang
Copy link
Contributor

ketang commented Jul 12, 2022

Only the template owners can make changes to the template, not even the admin. Of course, the admin can add themselves as an owner to make changes.

I think we should just do standard RBAC type stuff here.

We could also make this simpler and rely on version control capabilities to deal with permissions and mutexing with the to-be-built VCS integration add-on. Maybe we don't actually need to do anything natively.

@ammario
Copy link
Member Author

ammario commented Jul 13, 2022

RBAC with few owners serves as a basic mutex. I'm not proposing anything additional.

And yes, a template backed by VCS has a lot of nice properties.

@ammario
Copy link
Member Author

ammario commented Jul 14, 2022

This could be entirely replaced by #2958 I think.

@ketang
Copy link
Contributor

ketang commented Jul 14, 2022

Replacing this with the other issue means that anyone who doesn't want VCS-backed templates (or uses a VCS we don't support) will have no ability to manage multiple users' access. That's probably okay, but I wouldn't want to rely too confidently on that assumption in our implementation or brains.

@ammario
Copy link
Member Author

ammario commented Jul 14, 2022

We have never had a customer that doesn't use git repos with support for SSH cloning, so I don't think we need to worry about unsupported VCS.

@ammario ammario closed this as not planned Won't fix, can't repro, duplicate, stale Aug 18, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants