Collaborators need to be K8s members to trigger tests

[jlewi]

We are currently using K8s instance of prow to run our testing infrastructure.

One of the results of this is that collaborators on the tensorflow/k8s repo also need to be members of the kubernetes github organization otherwise they won't be able to trigger tests.

There are at least a couple ways we could deal with this

1. tensorflow/k8s collaborators could become k8s members; here are the guidelines
2. We could update the k8s bot so you don't need to be a k8s member if you have sufficient access to the repo.

Since we're using K8s test infra we probably need to follow their guidelines. So I'm leaning towards option 1.

[zjj2wry]

plugin.yaml:

triggers:
- repos:
  - kubernetes
  - kubernetes-incubator
  - kubernetes-security
  - google/cadvisor
  - tensorflow/k8s
  - GoogleCloudPlatform/k8s-multicluster-ingress
  trusted_org: kubernetes
  join_org_url: "https://github.com/kubernetes/community/blob/master/community-membership.md#member"

check user permission code:

func isUserTrusted(ghc githubClient, user, trustedOrg, org string) (bool, error) {
	orgMember, err := ghc.IsMember(trustedOrg, user)
	if err != nil {
		return false, err
	} else if orgMember {
		return true, nil
	}
	if org != trustedOrg {
		orgMember, err = ghc.IsMember(org, user)
		if err != nil {
			return false, err
		}
	}
	return orgMember, nil
}

@jlewi take a look test-infra code. Seems PR's org member can trigger CI. kubernetes is trusted_org for tensorflow/k8s, so kubernetes member also can trigger CI. but we can use tensorflow membership guidelines in join_org_url. And we only open trigger plugin, we can open lgtm,label,size plugin. seems it is helpful.

triggers:
- repos:
  - kubernetes
  - kubernetes-incubator
  - kubernetes-security
  - google/cadvisor
  - tensorflow/k8s
  - GoogleCloudPlatform/k8s-multicluster-ingress
  trusted_org: kubernetes
  join_org_url: "https://github.com/kubernetes/community/blob/master/community-membership.md#member"
- repos:
  - tensorflow/k8s
  trusted_org: kubernetes
  join_org_url: "tensorflow membership ..."

[jlewi]

Thanks.

I think we want to follow Kubernetes practices and membership guidelines not TensorFlow. I don't think requiring Kubeflow contributors to be members of either tensorflow or kubernetes organizations really makes sense; but that's one of the issues we can discuss at the community meeting.

Just so I understand the last comment, you're proposing we add the lgtm,label,size plugins for the tensorflow/k8s repo? What do those plugins do?

[zjj2wry]

@jlewi we can get some information in plugin-help.

[jimexist]

Following the Kubernetes org guideline, does contributing in tensorflow/k8s count?

[jlewi]

@jimexist Not sure who decides that.

I wonder if we could add an IsCollaborator method to github client and then allow tests to be triggered by members of the org or collaborators?

[jlewi]

Fixed as a result of us moving to the github org.