[PATCH conductor] Bug 807745 add 'use provider accounts' to global image admin role

Jozef Zigmund jzigmund at redhat.com
Wed May 30 13:28:55 UTC 2012


On Tuesday 29 May 2012 14:24:40 Scott Seago wrote:
> https://bugzilla.redhat.com/show_bug.cgi?id= 807745
> 
> Image admin role has been augmented to include view and use permissions
> on provider accounts. This allows global image admins to import
> images from any provider account.
> 
> To see the changes you need to run 'rake dc:upgrade' which performs the
> necessary data upgrade to get the role modification. The upgrade is
> currently implemented inline in the rake task -- the intent is
> for this task to eventually run a set of upgrade scripts from a
> dedicated 'upgrades' directory, but the infrastructure for  that is not
> yet set up.
> ---
>  src/db/seeds.rb             |    3 ++-
>  src/lib/tasks/dc_tasks.rake |   16 ++++++++++++++++
>  2 files changed, 18 insertions(+), 1 deletions(-)
> 
> diff --git a/src/db/seeds.rb b/src/db/seeds.rb
> index 71b4f62..529ad76 100644
> --- a/src/db/seeds.rb
> +++ b/src/db/seeds.rb
> @@ -112,7 +112,8 @@ roles =
>                                                  Quota           =>
> [VIEW]}], "base.image.admin"            => [false, {PoolFamily      =>
> [VIEW, USE], Catalog         => [VIEW,USE,MOD,CRE,VPRM,GPRM], -            
>                                    Deployable      =>
> [VIEW,USE,MOD,CRE,VPRM,GPRM]}], +                                          
>      Deployable      => [VIEW,USE,MOD,CRE,VPRM,GPRM], +                    
>                            ProviderAccount => [VIEW,USE]}], "base.admin"   
>               => [false, {Provider        => [VIEW,USE,MOD,CRE,VPRM,GPRM],
> ProviderAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], HardwareProfile => [VIEW, 
>   MOD,CRE,VPRM,GPRM], diff --git a/src/lib/tasks/dc_tasks.rake
> b/src/lib/tasks/dc_tasks.rake index 7c0a297..083e3e8 100644
> --- a/src/lib/tasks/dc_tasks.rake
> +++ b/src/lib/tasks/dc_tasks.rake
> @@ -164,6 +164,22 @@ namespace :dc do
> 
>    end
> 
> +  desc 'Data upgrade for conductor'
> +  # this should eventually be pulled out into a separate "upgrade
> everything in here" directory +  task :upgrade => :environment do
> +    Role.transaction do
> +      image_admin_role = Role.find_by_name("base.image.admin")
> +      if image_admin_role and image_admin_role.privileges.
> +          where(:target_type => "ProviderAccount").empty?
> +        ["view", "use"].each do |action|
> +          Privilege.create!(:role => image_admin_role,
> +                            :target_type => "ProviderAccount",
> +                            :action => action)
> +        end
> +      end
> +    end
> +  end
> +
>    def get_account(provider_name, account_name)
>      unless provider = Provider.find_by_name(provider_name)
>        raise "There is no provider with '#{provider_name}' name"

ACK, it's fixing the issue according to related BZ discussion.



More information about the aeolus-devel mailing list