Merge pull request #192 from vvalderrv/add-admin-groups

feat: add admin groups for LF teams

Author: vvalderrv

production/values.yaml

@@ -117,13 +117,21 @@ jenkins:
                 logoutUrl: "${SAML_LOGOUT_URL}"
                 maximumAuthenticationLifetime: 86400
 
-            # Authorization strategy - allow anonymous read access
+            # Authorization Strategy: Global Matrix Authorization
+            # Admin access: lf-releng, lf-sysops groups from LF LDAP
+            # Anonymous access: read-only for public CI transparency
             authorizationStrategy:
               globalMatrix:
                 permissions:
-                  - "Overall/Read:anonymous"
-                  - "Job/Read:anonymous"
-                  - "View/Read:anonymous"
+                  # Anonymous read-only access
+                  - "USER:Overall/Read:anonymous"
+                  - "USER:Job/Discover:anonymous"
+                  - "USER:Job/Read:anonymous"
+                  - "USER:View/Read:anonymous"
+
+                  # Admin groups (LF teams)
+                  - "GROUP:Overall/Administer:lf-releng"
+                  - "GROUP:Overall/Administer:lf-sysops"
 
             # Kubernetes cloud configuration for dynamic build agents
             clouds:
@@ -182,7 +190,11 @@ jenkins:
                       ebsOptimized: false
                       hostKeyVerificationStrategy: OFF
                       idleTerminationMinutes: "60"
-                      initScript: "sudo dnf clean all && sudo rm -rf /var/cache/dnf && sudo dnf repolist && sudo dnf update --releasever=latest --skip-broken --exclude=openssh* --exclude=docker* --exclude=gh* --exclude=openssl* -y && docker ps"
+                      initScript: >-
+                        sudo dnf clean all && sudo rm -rf /var/cache/dnf &&
+                        sudo dnf repolist && sudo dnf update --releasever=latest
+                        --skip-broken --exclude=openssh* --exclude=docker*
+                        --exclude=gh* --exclude=openssl* -y && docker ps
                       labelString: "Jenkins-Agent-AL2023-X64-c5.4xlarge-Single-Host"
                       launchTimeoutStr: "300"
                       maxTotalUses: 10

staging/values.yaml

@@ -117,13 +117,21 @@ jenkins:
                 logoutUrl: "${SAML_LOGOUT_URL}"
                 maximumAuthenticationLifetime: 86400
 
-            # Authorization strategy - allow anonymous read access
+            # Authorization Strategy: Global Matrix Authorization
+            # Admin access: lf-releng, lf-sysops groups from LF LDAP
+            # Anonymous access: read-only for public CI transparency
             authorizationStrategy:
               globalMatrix:
                 permissions:
-                  - "Overall/Read:anonymous"
-                  - "Job/Read:anonymous"
-                  - "View/Read:anonymous"
+                  # Anonymous read-only access
+                  - "USER:Overall/Read:anonymous"
+                  - "USER:Job/Discover:anonymous"
+                  - "USER:Job/Read:anonymous"
+                  - "USER:View/Read:anonymous"
+
+                  # Admin groups (LF teams)
+                  - "GROUP:Overall/Administer:lf-releng"
+                  - "GROUP:Overall/Administer:lf-sysops"
 
             # Kubernetes cloud configuration for dynamic build agents
             clouds: