Cloud.gov Workshop Configuration
Configuration for IaC managed resources in Cloud.gov Workshop
| Type | object |
|---|---|
| File match |
cg-workshop.yml
**/cg-workshop/*.yml
|
| Schema URL | https://catalog.lintel.tools/schemas/schemastore/cloud-gov-workshop-configuration/latest.json |
| Source | https://workshop.cloud.gov/workshop/workshop-schemas/-/raw/main/cg-workshop.schema.json |
Validate with Lintel
npx @lintel/lintel checkSchema for the Cloud.gov Workshop configuration files. Top level keys subgroups and projects are valid for Customer configs. Top level keys namespaces and users are valid for the Workshop-controlled configurations.
Properties
Workshop top level groups. This key is invalid in customer config files.
Workshop customer projects.
Workshop customer sub-groups.
Team groups to provision. These groups are used specifically for role management.
Workshop users to provision. This key is invalid in customer config files.
Definitions
Namespace (top level group) - The key can use any sequence of letters, numbers, underscores, hypens, and dots
Friendly name for the group
Friendly description for the group
Path (slug) for group - Defaults to the group key name
Optional overrides for the related customer configuration project
4 nested properties
Number of approvals needed for a MR to the config project
Default merge method
Require at least one approval from a namespace owner before merging
Squash commits on merge request merge
[Optional] Key/value pairs to set as custom attributes (Requires admin permission)
Group is required to bootstrap Workshop
Namespace visibility - private (members only), public (including anonymous), or internal (visible to other Workshop users)
Use a custom project template
List of owners for the group
Whether the namespace group wiki is enabled, disabled, or private
Runner pool configuration
18 nested properties
Allow SSH access to manager and egress spaces. Defaults to false
List of Cloug.gov operators allowed to interact with the group runner spaces
Maximum concurrent jobs to run per-worker manager
Docker Hub username for runner workers to pull images
Name of the environment variable holding the token for the Docker Hub user
Egress HTTPS proxy mode for runner workers and services
Allow runner workers to SSH to runner services
Number of worker managers to run
Size of the runner worker pool
Register the runner pool to the group
List of TCP ports the egress proxy will allow outbound connection to for job services
List of additional fully qualified domain names to allow outbound to the Internet by runner job services over HTTPS
List of fully qualified domain names to block outbound to the Internet by runner job services over HTTPS
List of technologies used under the group requiring egress allowance over HTTPS byrunner workers
List of additional fully qualified domain names to allow outbound to the Internet by runner workers over HTTPS
List of fully qualified domain names to block outbound to the Internet by runner workers over HTTPS
List of TCP ports the egress proxy will allow outbound connection to for runner workers
Allow unfettered outbound Internet access [DANGER!]
Project - The key can use any sequence of letters, numbers, underscores, hypens, and dots
Friendly name for the project
Friendly description for the project
Project visibility - private (members only), public (including anonymous), or internal (visible to other Workshop users)
Subgroup project is under - Defaults to the namespace
Archive - When true sets repository to read-only state
Number of approvals needed for a MR
Allow merge request committers to approve their own merge requests. Defaults to false. A merge request committer is a user who has added commits to the merge request's source branch.
List of compliance framework names to apply to the project. Names must exist in the namespace already. See https://workshop.cloud.gov/help/user/compliance/compliance_center/compliance_frameworks_report/#create-a-new-compliance-framework for more details.
3 nested properties
Existing project ID to import as a new IaC managed resource
[DEPRECATING] Namespace path project is under - Defaults to the namespace / subgroup_key
Whether to treat skipped pipelines as successful when merging. Defaults to false
Whether merge requests can be merged only after all discussions are resolved. Defaults to true
Whether merge requests can be merged only if the pipeline succeeds. Defaults to true
Project path (slug name) - Overrides the default path derived from the key name
Project tags that are protected
Additional groups outside of the inheritence structure to share the project with, giving the group's members access to the project - Supports default roles docs.gitlab.com/user/permissions/#default-roles with a key of lower cased plural role name (e.g. The key developers will share the project with the group and give members the developer role)
Whether project code snippets are enabled. Deprecated in favor of snippets_access_level
Whether project code snippets are enabled, disabled, or private.
Whether the project wiki is enabled, disabled, or private
https url to import repository from. Use with mirror: true to set up a pull mirror to keep the repository up to date.
Name of the environment variable holding the import_url_password value. Used with import_url_username.
Username that can access import_url. Required for private repositories. Optional for public repositories.
Rules for pushing to the repository
12 nested properties
Users can only push commits to this repository that were committed with one of their own verified emails.
Restrict commits by author (email) to existing GitLab users.
Do not allow deleting tags with a push
Reject any files that are likely to contain secrets
Reject commits that do not have a valid DCO sign-off
Subgroup (any group other than a top level namespace) - The key can use any sequence of letters, numbers, underscores, hypens, and dots
Friendly name for the group
Subgroup visibility - private (members only), public (including anonymous), or internal (visible to other Workshop users)
Path (slug) for group - Defaults to the group key name
Parent group full path for the subgroup. Defaults to the top level namespace
Friendly description of the group
Existing subgroup ID to import as a new IaC managed resource
Roles and their memberships under the subgroup - Supports both default roles docs.gitlab.com/user/permissions/#default-roles and custom roles https://docs.gitlab.com/user/custom_roles/ with a key of lower cased plural role name (e.g. The key developers will create a group Developers that give members the developer role)
Additional groups outside of the inheritance structure to grant a role on the subgroup. This gives the group's members access to the subgroup and all of its projects. Supports default roles https://docs.gitlab.com/user/permissions/#default-roles by matching the key to lowercased and pluralized role names (e.g. The key 'developers' will share the project with the group and give members the developer role)
Whether the group wiki is enabled, disabled, or private
Team group - used to create groups for easy @mentions and group-based assignments — not necessarily for role-based access control. The key can use any sequence of letters, numbers, underscores, hyphens, and dots.
Friendly name for the team
List of users to assign as team members.
Friendly description of the team
Role to assign the team on the full namespace. Defaults to none (no access)
Role to assign the team for Workshop's configuration projects — i.e., the configuration project this schema applies to, the templates project, and other Workshop-generated config projects. Defaults to developer, set to none to remove access
User object - The key must be the user's US government email address under a .gov domain
Full name of user
[Optional] Key/value pairs to set as custom attributes (Requires admin permission)
[Optional] Existing GitLab user ID on the system to import
[Optional] Additional notes about the user
[Optional] Personal project limit
[Optional] Forced state of the user account
[Optional] Custom username - Overrides the default username from the user email address