On 05/26/2011 07:00 AM, Mark McLoughlin wrote:
> I agree with Scott's concerns here on the multiple account per provider
> thing. I don't know the answer either, so for a first pass, perhaps we
> just limit it to 1 account?
We could do this two ways:
- image factory will be passed a set of credentials and, if there are
multiple credentials for a provider, it can just pick the first one
- image factory will push to all the accounts provided and, if there
are multiple accounts, conductor will only return a single account
per provider when queried by the CLI
I'm happy with either, perhaps the former is easier
There's a bit of
subtlety that's missing here now. In the case where
there are multiple provider accounts in a single provider, Conductor
currently assumes that any images mapped to that provider are accessible
by both provider accounts.
For this to work as Conductor currently assumes, if there are two
accounts on one provider, the "push" operation must create a single
provider image (i.e. push with one provider account) and then _share_
this image with the other. In the ec2 case, this means one user must
bundle/register the AMI and then grant access to the other account. I
know you can do this via the AWS Web UI by providing the AWS account ID
of the user you want to grant AMI access to. I'm not sure how this is
done via the API. Nor do I know how other providers handle this.
The other alternative is to update our model and make Provider Images
Account-specific, and then have Factory push a separate image to each
account on a provider.
If the default use case is one account per provider, and we'll only
occasionally have multiple accounts in a provider, the latter solution
is the simplest one -- the only downside is that if there are a bunch of
accounts on one provider, the users will be wasting storage (and
incurring additional storage costs).
The downside of the former solution is the additional modeling/image
logic overhead -- we'll have to keep track of which account owns each
provider image, and in addition which accounts we've shared access with.
The more fundamental downside is we're assuming that all providers
support image sharing across accounts -- we'll need to confirm w/ the DC
API team whether this is a valid assumption.
Scott