Decide on how to manage admin access

[j08lue]

Dedicated GitHub team, or?

History: Current GitHub IdP based setup was chosen for our initial PoC.

Options

1. Membership of a specified GitHub org + team --> GitHub is the sole IdP for admin access

• Cons:
  • Only one IdP
• Pros:
  • Solution is already around the corner

2. Membership in a dedicated group in KeyCloak + policies

• Questions:
  • Where would we define this configuration? GitOps config - would that mean to store admin emails publicly (in config YAML files in Git)?
    • Definition of groups could be via GitOps, but membership could be managed manually via admin interface.

Decision drivers

1. Avoid repeated downtime (when adding a new admin)
2. Avoid requiring code changes in all IdPs

[j08lue]

Preliminary decision: Move forward with GitHub IdP solution for now

• Restrict VEDA master realm access to members of Github team #13

Possible to change later.