Page MenuHomePhabricator

Prevent creation of private projects by default on WMF GitLab
Closed, ResolvedPublic

Description

I did some digging before asking in #gitlab on libera.chat:

16:48 <brennen> howdy.  does anybody know if it's possible (in gitlab CE specifically) to disable private projects for individual users?
16:49 <brennen> that is, i'd like to let people create projects, but only public ones, for the majority of users of our instance.
17:14 <certifiable> brennen: There isn't deep granularity on that.  You can restrict possible visibility levels (https://docs.gitlab.com/ee/user/admin_area/settings/visibility_and_access_controls.html#restricted-visibility-levels) and prevent "Private".  But then admins would be the only ones able to make projects Private.                                     
17:15 <certifiable> There's no way to grant that right to a selected non-admin group of users.

Per the linked docs, this seems right, and I've applied that setting. Will need to confirm that a user can request an admin make a project private and access it the usual way. Once that's done, we can probably safely merge 699819.

To be clear, this assumes that we can set the policy to:

  • Users may create publicly visible projects under their own accounts.
  • Any team or user with a use case for a private project will need to file a request, which admins will evaluate on a case-by-case basis.

cc: @thcipriani, @greg for review on that decision.

Event Timeline

Change 699819 had a related patch set uploaded (by Brennen Bearnes; author: Brennen Bearnes):

[operations/gitlab-ansible@master] CAS: stop marking users as external

https://gerrit.wikimedia.org/r/699819

To be clear, this assumes that we can set the policy to:

  • Users may create publicly visible projects under their own accounts.
  • Any team or user with a use case for a private project will need to file a request, which admins will evaluate on a case-by-case basis.

cc: @thcipriani, @greg for review on that decision.

This is an improvement on the current status quo where users file a request for all project creation, so I'm +1. What about group creation and project creation under a group namespace?

This is an improvement on the current status quo where users file a request for all project creation, so I'm +1. What about group creation and project creation under a group namespace?

Individual users have a boolean for "can create groups". My assumption has been that there'll be a request process for new top-level groups. Within a group, subgroup creation can be limited to Owners or Maintainers, while project creation can be limited Maintainers + Developers, just Maintainers, or restricted entirely.

(For reference, the user role hierarchy seems to be, from least empowered to most: Guest, Reporter, Developer, Maintainer, Owner.)

Change 699819 merged by Brennen Bearnes:

[operations/gitlab-ansible@master] CAS: stop marking users as external

https://gerrit.wikimedia.org/r/699819

Will need to confirm that a user can request an admin make a project private and access it the usual way.

Confirmed this works; deploying "stop marking users as external" patch.

brennen claimed this task.
brennen moved this task from In Progress to Done on the GitLab (Initialization) board.
brennen moved this task from INBOX to Doing on the Release-Engineering-Team board.