[PATCH conductor] Bug 807745 add 'use provider accounts' to global image admin role

Scott Seago sseago at redhat.com
Tue May 29 18:24:40 UTC 2012


https://bugzilla.redhat.com/show_bug.cgi?id= 807745

Image admin role has been augmented to include view and use permissions
on provider accounts. This allows global image admins to import
images from any provider account.

To see the changes you need to run 'rake dc:upgrade' which performs the
necessary data upgrade to get the role modification. The upgrade is
currently implemented inline in the rake task -- the intent is
for this task to eventually run a set of upgrade scripts from a
dedicated 'upgrades' directory, but the infrastructure for  that is not
yet set up.
---
 src/db/seeds.rb             |    3 ++-
 src/lib/tasks/dc_tasks.rake |   16 ++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletions(-)

diff --git a/src/db/seeds.rb b/src/db/seeds.rb
index 71b4f62..529ad76 100644
--- a/src/db/seeds.rb
+++ b/src/db/seeds.rb
@@ -112,7 +112,8 @@ roles =
                                                 Quota           => [VIEW]}],
       "base.image.admin"            => [false, {PoolFamily      => [VIEW, USE],
                                                 Catalog         => [VIEW,USE,MOD,CRE,VPRM,GPRM],
-                                                Deployable      => [VIEW,USE,MOD,CRE,VPRM,GPRM]}],
+                                                Deployable      => [VIEW,USE,MOD,CRE,VPRM,GPRM],
+                                                ProviderAccount => [VIEW,USE]}],
       "base.admin"                  => [false, {Provider        => [VIEW,USE,MOD,CRE,VPRM,GPRM],
                                                 ProviderAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM],
                                                 HardwareProfile => [VIEW,    MOD,CRE,VPRM,GPRM],
diff --git a/src/lib/tasks/dc_tasks.rake b/src/lib/tasks/dc_tasks.rake
index 7c0a297..083e3e8 100644
--- a/src/lib/tasks/dc_tasks.rake
+++ b/src/lib/tasks/dc_tasks.rake
@@ -164,6 +164,22 @@ namespace :dc do
 
   end
 
+  desc 'Data upgrade for conductor'
+  # this should eventually be pulled out into a separate "upgrade everything in here" directory
+  task :upgrade => :environment do
+    Role.transaction do
+      image_admin_role = Role.find_by_name("base.image.admin")
+      if image_admin_role and image_admin_role.privileges.
+          where(:target_type => "ProviderAccount").empty?
+        ["view", "use"].each do |action|
+          Privilege.create!(:role => image_admin_role,
+                            :target_type => "ProviderAccount",
+                            :action => action)
+        end
+      end
+    end
+  end
+
   def get_account(provider_name, account_name)
     unless provider = Provider.find_by_name(provider_name)
       raise "There is no provider with '#{provider_name}' name"
-- 
1.7.6.5




More information about the aeolus-devel mailing list