Skip to content

SE-87 Limit SSH access to sandboxes and self-hosted instances

Boros Gábor requested to merge jazzar/limit-ssh-access into master

Created by: iamjazzar

Task: OC-5077.

This code change is to limit the sandbox ssh access to the Github users' of the organization that owns the Sandbox. We can restrict the access more to the github users that are also users on OpenCraft, but I found it out-of-scope so I didn't add it. This PR left some stale methods and removed some tests in the same time, these to be addressed in OC-5237.

Test Instructions

  1. Create an Organization and a corresponding WatchedFork object.
  2. Make sure to specify a valid github_username for your OCIM user (via the corresponding UserProfile).
  3. Add your OCIM user to the Organization created in the previous step.
  4. Set the fork field of the WatchedFork created previously to the GitHub name of the fork against which you'll be creating PRs.
  5. Check that OCIM automatically granted SSH access to the created instance to all members of the Organization.
  6. Check that OCIM automatically granted SSH access to the created instance to all OCIM users with superuser privileges.
  7. Check the new AppServer configuration for COMMON_USER_INFO and make sure that there're no users from outside the organization and the admin users.
  8. Create a new instance that's not linked with a WatchedFork and make sure that OCIM admins are the only ones who can access that server.

Merge request reports