[PATCH conductor] Bug 807745 add 'use provider accounts' to global image admin role
Jozef Zigmund
jzigmund at redhat.com
Wed May 30 13:28:55 UTC 2012
On Tuesday 29 May 2012 14:24:40 Scott Seago wrote:
> https://bugzilla.redhat.com/show_bug.cgi?id= 807745
>
> Image admin role has been augmented to include view and use permissions
> on provider accounts. This allows global image admins to import
> images from any provider account.
>
> To see the changes you need to run 'rake dc:upgrade' which performs the
> necessary data upgrade to get the role modification. The upgrade is
> currently implemented inline in the rake task -- the intent is
> for this task to eventually run a set of upgrade scripts from a
> dedicated 'upgrades' directory, but the infrastructure for that is not
> yet set up.
> ---
> src/db/seeds.rb | 3 ++-
> src/lib/tasks/dc_tasks.rake | 16 ++++++++++++++++
> 2 files changed, 18 insertions(+), 1 deletions(-)
>
> diff --git a/src/db/seeds.rb b/src/db/seeds.rb
> index 71b4f62..529ad76 100644
> --- a/src/db/seeds.rb
> +++ b/src/db/seeds.rb
> @@ -112,7 +112,8 @@ roles =
> Quota =>
> [VIEW]}], "base.image.admin" => [false, {PoolFamily =>
> [VIEW, USE], Catalog => [VIEW,USE,MOD,CRE,VPRM,GPRM], -
> Deployable =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM]}], +
> Deployable => [VIEW,USE,MOD,CRE,VPRM,GPRM], +
> ProviderAccount => [VIEW,USE]}], "base.admin"
> => [false, {Provider => [VIEW,USE,MOD,CRE,VPRM,GPRM],
> ProviderAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], HardwareProfile => [VIEW,
> MOD,CRE,VPRM,GPRM], diff --git a/src/lib/tasks/dc_tasks.rake
> b/src/lib/tasks/dc_tasks.rake index 7c0a297..083e3e8 100644
> --- a/src/lib/tasks/dc_tasks.rake
> +++ b/src/lib/tasks/dc_tasks.rake
> @@ -164,6 +164,22 @@ namespace :dc do
>
> end
>
> + desc 'Data upgrade for conductor'
> + # this should eventually be pulled out into a separate "upgrade
> everything in here" directory + task :upgrade => :environment do
> + Role.transaction do
> + image_admin_role = Role.find_by_name("base.image.admin")
> + if image_admin_role and image_admin_role.privileges.
> + where(:target_type => "ProviderAccount").empty?
> + ["view", "use"].each do |action|
> + Privilege.create!(:role => image_admin_role,
> + :target_type => "ProviderAccount",
> + :action => action)
> + end
> + end
> + end
> + end
> +
> def get_account(provider_name, account_name)
> unless provider = Provider.find_by_name(provider_name)
> raise "There is no provider with '#{provider_name}' name"
ACK, it's fixing the issue according to related BZ discussion.
More information about the aeolus-devel
mailing list