fix: add --ignore-secret-teams to peribolos workflows#118
Merged
marcusburghardt merged 1 commit intoMay 29, 2026
Merged
Conversation
Peribolos with --fix-team-repos strips team-repo permissions for any repo not declared in peribolos.yaml. Private repos deliberately excluded from the public config had their manually-set team permissions removed on every scheduled or push-triggered apply run. Adding --ignore-secret-teams causes peribolos to skip secret-privacy teams entirely (creation, deletion, membership, and repo mappings), allowing manually-managed secret teams to grant access to private repos without interference. Affected workflows: - peribolos-apply.yml (daily apply + push to main) - peribolos-drift.yml (weekly drift detection) Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Peribolos with
--fix-team-reposreconciles each team's repo permissions to match exactly what's declared inperibolos.yaml. Private repos deliberately excluded from the public config had their manually-set team permissions stripped on every scheduled or push-triggered apply run.The
--fix-team-reposflag computesunused = have - wantfor each team's repo list and removes all repos not in the YAML. Since private repos are intentionally omitted fromperibolos.yaml, any team access manually granted to those repos was removed by the next peribolos run.This PR adds
--ignore-secret-teamsto both peribolos workflows (peribolos-apply.ymlandperibolos-drift.yml), causing peribolos to completely skip secret-privacy teams (creation, deletion, membership, and repo mappings). This allows manually-managed secret teams to grant access to private repos without interference.Note: no secret teams currently exist in the managed config, so this change has no side effects on existing team management. Long-term, an
--exclude-reposflag contributed upstream tokubernetes-sigs/prowwould provide more granular control.Related Issues
Review Hints
--ignore-secret-teamsright after the existing--ignore-enterprise-teamsflag.kubernetes-sigs/prow/cmd/peribolos/main.go— it causes secret-privacy teams to be excluded from theslugsset entirely, making them invisible to the delete and reconciliation logic.workflow_dispatchofperibolos-apply.ymlwithdry-run: trueand confirm secret teams are not listed in the output.