From: "Hugh Brock" <hbrock(a)redhat.com>
Date: Wed, 27 Jul 2011 16:40:50 -0400
On Wed, Jul 27, 2011 at 09:31:44AM -0400, Dmitri Pal wrote:
> On 07/27/2011 05:30 AM, Mark McLoughlin wrote:
> > - It's fine if Joe has launch access to all images; we just need to
> > make sure that Joe can't delete or overwrite images. Perhaps this
> > means that Joe has no direct access to IWHD or Image Factory at
> > all, only the images list in Conductor
> >
> That would be perfect but what prevents him to use IWHD CLI and access
> the objects directly? I was talking about this issue from the very
> beginning. If the plan is that only a subset of the users will be
> allowed to use IWHD and all the rest will have to interact with
> Conductor this is fine but I never seen this spelled out.
It seems to me that we could probably save the IWHD guys a lot of work
if we lock down IWHD so that you can only access it if you have valid
credentials in either Conductor or Katello.
I agree that it will save the iwhd team some work if we can settle on
this architecture. In what timeframe can we get ACKs from the
affected teams (katello and conductor, to my knowledge) that this is
in fact the architecture that we'll go with? Or not. Hugh? Brian?
We'll need to make sure factory can also access it; I'll work with
the factory team to run that issue to ground.