[Feature Request] Ability to use github teams as admins

[kylebyerly-hp]

I would like to be able to use github teams for the admins over github users. I was not able to do so with drone v0.5.0 and github enterprise (I tried org/team and org/team and org\/team just in case there were escaping issues, but suspect teams are simply not enabled).

[msuterski]

I second this. It's easier to manage groups over deploying new drone instances.

[ptagr]

+1.

[tonglil]

Or even just to specify one team (vs checking multiple teams/etc):

DRONE_ADMIN_TEAM=org/my-team
DRONE_ADMIN_USERS=janedoe,johnsmith

Let the integration driver handle:

• Mapping the value of the env var to the actual semantic of that platform
• Calling APIs to fetch the users from that platform
• Union list of users and users in the team

Might have to think about:

• How to concat fetched users and users listed in DRONE_ADMIN_USERS
• Periodicity of refreshing list of users from the team (since teams can change)

[bradrydzewski]

I am looking at 2 options:

1. provide a sidecar image that can regularly poll an organization and automatically add / remove / update users via the API. I will host a simple version of this utility in the Drone org and teams that need something more complex will be able to fork and modify as needed.

2. allow an authorization plugin that invokes a microserver when a user authenticates. This microservice will receive the user details and the http response will dictate whether or not the user account is authorized to proceed, and what role (e.g. admin) they should assume.

I am leaning toward the second option, since this is what we are doing with secrets, registry credentials, pipeline approvals, etc.

[tboerger]

The second approach really matches best the upcoming capabilities.

[bradrydzewski]

Drone supports basic admission plugins for new user login. I need to update the code to also invoke the admission endpoint for existing user login. I also need to create a boilr template for admission plugins. Once these are complete it should allow the creation of a plugin to satisfy this use case.

[bradrydzewski]

This is now possible in the latest build. We pushed support for admission extensions that allow you to customization system access and admin access.

We published an boilr project to help create admission extensions:
https://github.com/drone/boilr-admission

We created a sample extension that grants access to organization members, grants admin access to organization admins, and (optionally) grants admin access to members of a designated team:
https://github.com/drone/drone-admit-members

This requires the latest build and will be included in the 1.5.0 tagged release.