Arrange ownership transfer for api_admin and api-manager

[robrap]

A/C:

• Identify an appropriate team willing to take on ownership of this Django app
• Write up a transfer plan
• Execute the plan

Context:

• According to the ownership spreadsheet, arch-bom owns openedx/core/djangoapps/api_admin.
• Arch-bom does not monitor any API access requests.
• Enterprise monitors these requests for enterprise partners.
• Internal users sometimes make these requests.
  • No one knows who own the process for approval, not what the process should be.
  • There have been way too many Slack threads on this. Here is a recent Slack thread that points to at least one older thread.
• HelpDesk has been approving on an adhoc basis after repeated discussions in Slack.

Questions:

• What is the fastest way for @robrap/arch-bom to no longer be pinged on these requests?
• Kelly raised security concerns when @robrap proposed auto-approval for internal users. Are there real concerns? Should Security WG or CyberSecurity weigh in?
• Can Enterprise own the whole thing? Presumably whatever process they use to ensure partners know how to use this responsibly could be replicated for internal users, if anything is done at all.
• Would HelpDesk be willing to implement the approval long-term if they knew what the process was?

[robrap]

@davidjoy: Maybe you could take this from an ownership perspective to start? I created a ticket just to capture the information.

[robrap]

A similar topic is ownership of api-manager. I just created edx/api-manager#233, as an example of what the owner might do.

• Should api-manager ownership be considered as part of this ticket, or would we want a separate "arrange ownership transfer" ticket for it?
• Part of the initial thinking around this ownership was that the architecture team should provide guidance/governance around the decision making for key infrastructure like this. Is it possible to split guidance from long-term ownership? Do we want to ensure that the owning team is also equipped to have the vision and guidance for the infrastructure (e.g. knows when it should change, or be retired, or be enhanced, etc.)? We might ask a similar set of questions about the event-bus. Note that MFEs got off the ground with the arch squad, but now there is a WG and other teams that are responsible for that moving forward.

[davidjoy]

FYI, I haven't been able to make any progress here, unfortunately, what with getting pulled into other projects.

[robrap]

@davidjoy: I just unassigned this from you. I've assumed at this point that you are on other things, and this is on our groomed backlog. You are welcome to assign this to yourself if you ever want to move it to in-progress, but otherwise, I don't think it makes sense to make you a blocker on any of the arch-bom tickets. Let me know if you disagree.

[robrap]

[inform] The api-manager ownership question has come up recently due to ongoing TNL work. We may want to consider re-prioritizing this as P2 (blocking other teams). See Slack thread. FYI: @jmbowman

[robrap]

Moving this to backlog as Future work until post reorg in early 2024, when we have more info about what our team will be and what the new org structure looks like.

[robrap]

Adding one more Slack thread for reference. There are many.

[jristau1984]

Closing for now, as no better owner exists in the slimmed down eng org.