Access to CF for @avivkeller

[avivkeller]

cc @nodejs/build @nodejs/TSC

I currently only have access to the Node.js Sandbox account (web infra's testing account), but likely need access to the main account to properly configure integrations with our GitHub account.

The TSC has some more context behind said integrations. I don't need full access, just the ability to create and manage workers and pages.

[richardlau]

Is it enough to invite you into the Administrators group that @ovflowd @bmuenzenmeyer and @MattIPv4 are in (I think as part of #4194)?

[ovflowd]

Is it enough to invite you into the Administrators group that @ovflowd @bmuenzenmeyer and @MattIPv4 are in (I think as part of #4194)?

I'm unsure if Read-only or write access. We oughta check based on the documentation on nodejs/web-team. I recall Administrator access was only meant for web-admins? (I could be wrong) I believe both me, Brian or Matt can handle all the things Aviv needs.

Wdyt Matt/Brian, should Aviv have admin access on Cf or should he defer his needs to us/build wg/openjs infra team?

[MattIPv4]

Having access to Cf is a lot of power, it gives someone full control and the ability to hijack Node.js' entire binary distribution. Per https://github.com/nodejs/web-team/blob/main/PERMISSIONS.md#external-services web-infra should only have read access, and any changes that require write access should be handled by web-admins.

[avivkeller]

If y'all aren't comfortable with it, I'm happy to defer to you.

I also definitely don't need as much access, only to workers and pages.

[MattIPv4]

My preference would be that we stick to the existing documented permissions and web-admins can handle changes required, but I'll let Brian/Claudio chime in.

[ovflowd]

If y'all aren't comfortable with it, I'm happy to defer to you.

I also definitely don't need as much access, only to workers and pages.

I'm not much fan of this wording. It's not about being comfortable, but following guidelines/documented agreements. If we start deciding things undocumentedly and without agreement left-n-right, this becomes pretty chaotic.

[ovflowd]

If y'all aren't comfortable with it, I'm happy to defer to you.

I also definitely don't need as much access, only to workers and pages.

Could you share on Slack what you need to do? And is there an issue opened for the work you need to do?

[avivkeller]

The only thing that my access, if it was to be granted would need would be to create Workers & Pages, for the same reason we installed the app, to deploy workers and pages for the repositories we discussed.

[MattIPv4]

Sure, but that'd give you write access to workers afaik, which would allow for a full hijack of Node.js' distribution. I trust you, but I think we should follow the existing trust model rather than expanding it.

[bmuenzenmeyer]

Having access to Cf is a lot of power, it gives someone full control and the ability to hijack Node.js' entire binary distribution. Per https://github.com/nodejs/web-team/blob/main/PERMISSIONS.md#external-services web-infra should only have read access, and any changes that require write access should be handled by web-admins.

Same table says access is case by case. I had to refer to it just now to recall that this is owned by build, not web, and therefore even web-inra only has read. It'd be nice if it could be more granular.

Case by case suggests there is room to explore here for scenarios like this.

[MattIPv4]

If we can get granular enough with the access control that the access is only granted to the specific Workers that are being created for the build previews here, I'm open to exploring that as an appropriate level of access for web-infra.

However, if the scope of the access is going to be all Workers, or beyond that, I unfortunately feel I need to hard block this. I don't think that is a safe level of access, both from a security perspective and also just that changes in Cloudflare are unilateral with no easy history/revert, with the blast radius being the entirety of the Node.js project, including the binaries downloaded by everyone.

[flakey5]

Not sure how much of a say I have here but +1 to web-infra just having read only access, also what we were trying to do with #4194. Nothing related to lack of trust in this case ofc, just that the user permissions for the Cloudflare dash aren't granular enough like Matt said

[avivkeller]

Noted. Could I be granted read access (from my current lack of any access) to I can monitor the usage of these features, and then I'll defer to those with admin to actually configure?

(Once again, of course, I can defer entirely)

[ovflowd]

Noted. Could I be granted read access (from my current lack of any access) to I can monitor the usage of these features, and then I'll defer to those with admin to actually configure?

(Once again, of course, I can defer entirely)

Absolutely fair by me :) -- +1