Tilt: Private team cloud snapshots

[victorwuky]

Background

Currently, cloud snapshots are public to the internet. With the concept of a team, we now have a natural access control.

Description

Create a team snapshot and access it from the Tilt Cloud team page.

From Tilt:

Public snapshots are an existing feature of Tilt / Tilt Cloud. For our new concept of teams, so far all users have requested private snapshots only. So this initial version will restrict to only the private version. I.e. if the Tilt project / Tiltfile you are using is for a team, you will _only_ be allowed to create a private team snapshot. Public snapshots will not be available.

From the Tilt Cloud team page:

• If you are a team member or a team owner, you can create a snapshot that will be associated with the team. (See https://docs.tilt.dev/teams.html about team membership.)
• Maybe we will also allow the None role to create a team snapshot as well, but they won't be able to access it immediately until they become at least a team member. This will likely be a future improvement.
• All team members and team owners can view all team snapshots. But nobody else can view these team snapshots.
• A team owner can delete any team snapshot.
• If you created the team snapshot, you can delete it.

Related

https://github.com/windmilleng/tilt/issues/3067 talks about private snapshots, but that's outside of a team setting, and more generic. This is about sharing at once to a team only, similar to how for a Google doc, you can share it within your entire organization if you are using Google apps for your business/domain.

[victorwuky]

A user has suggested that a team owner should be able to delete team snapshots (even if they are created by another user). Logging this here as an idea/ feature.

[andymartin-sch]

A user has suggested that a team owner should be able to delete team snapshots (even if they are created by another user). Logging this here as an idea/ feature.

a driver for this is that if an admin becomes aware that some keys or other sensitive material happened to be logged, we would want a quick way to purge past affected snapshots without having to interrupt individual application engineers and request that they delete them

[victorwuky]

Thanks @andymartin-sch , that makes a lot of sense!

[victorwuky]

@andymartin-sch : I've updated the description to be explicit who can delete a snapshot. Feel free to take a look and let me know if you'd prefer something else. I also created https://github.com/windmilleng/tilt/issues/3260 and https://github.com/windmilleng/tilt/issues/3261. Do take a look and comment there / upvote if they are of interest.

[theothertomelliott]

Looking at the mock, it seems like private snapshots are opt-in at the point of creating the snapshot.

In the interest of preventing information leaking, it would be useful to be able to disable public snapshots on a Tiltfile entirely.

[andymartin-sch]

Looking at the mock, it seems like private snapshots are opt-in at the point of creating the snapshot.

In the interest of preventing information leaking, it would be useful to be able to disable public snapshots on a Tiltfile entirely.

+1, was going to leave a similar comment. We would prefer no public snapshots ever for our team, but if others need this, maybe a block_public_snapshots-like flag could be added to set_team or disable_snapshots?

[victorwuky]

Thanks @theothertomelliott and @andymartin-sch ! I should've considered this more closely. I updated the description with saying that _only_ private snapshots are available in the context of a team. @andymartin-sch thanks for mentioning those flags / functions. We'll definitely dig into it further when we get to detailed implementation on a final design. But my initial thought is that it would be hardcoded so we wouldn't even need those flags. But we'll see!

[victorwuky]

Closing this since we have https://docs.tilt.dev/snapshots.html#private-snapshots-aka-team-snapshots now.