Change Details

IIRC the custom project members Horizon panel uses novaadmin credentials due to some upstream limitation. That unfortunately blocks using OpenTofu or other API clients to manage project membership. We are //maybe// only interested in tracking project membership via tofu-infra for the WMCS people in the WMCS-controlled projects. Community controlled projects have self-service project membership and we should not track them via tofu-infra.

IIRC the custom project members Horizon panel uses novaadmin credentials due to some upstream limitation. That unfortunately blocks using OpenTofu or other API clients to manage project membership. This limitation should not be a problem for Cloud admins using [[ https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS/Admin/tofu-infra | tofu-infra ]], where novaadmin credentials can be used. It is a problem for folks [using OpenTofu to manage their own Cloud VPS project](https://wikitech.wikimedia.org/wiki/Help:Using_OpenTofu_on_Cloud_VPS).

IIRC the custom project members Horizon panel uses novaadmin credentials due to some upstream limitation. That unfortunately blocks using OpenTofu or other API clients to manage project membership. We are //maybe// only interested in tracking project membership via tofu-infra for the WMCS people in the WMCS-controlled projectsThis limitation should not be a problem for Cloud admins using [[ https://wikitech.wikimedia.org/wiki/Portal:Cloud_VPS/Admin/tofu-infra | tofu-infra ]], where novaadmin credentials can be used. Community controlled projects have self-service project membership and we should not track them via tofu-infraIt is a problem for folks [using OpenTofu to manage their own Cloud VPS project](https://wikitech.wikimedia.org/wiki/Help:Using_OpenTofu_on_Cloud_VPS).