https://bugzilla.redhat.com/show_bug.cgi?id= 807745
Image admin role has been augmented to include view and use permissions on provider accounts. This allows global image admins to import images from any provider account.
To see the changes you need to run 'rake dc:upgrade' which performs the necessary data upgrade to get the role modification. The upgrade is currently implemented inline in the rake task -- the intent is for this task to eventually run a set of upgrade scripts from a dedicated 'upgrades' directory, but the infrastructure for that is not yet set up. --- src/db/seeds.rb | 3 ++- src/lib/tasks/dc_tasks.rake | 16 ++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletions(-)
diff --git a/src/db/seeds.rb b/src/db/seeds.rb index 71b4f62..529ad76 100644 --- a/src/db/seeds.rb +++ b/src/db/seeds.rb @@ -112,7 +112,8 @@ roles = Quota => [VIEW]}], "base.image.admin" => [false, {PoolFamily => [VIEW, USE], Catalog => [VIEW,USE,MOD,CRE,VPRM,GPRM], - Deployable => [VIEW,USE,MOD,CRE,VPRM,GPRM]}], + Deployable => [VIEW,USE,MOD,CRE,VPRM,GPRM], + ProviderAccount => [VIEW,USE]}], "base.admin" => [false, {Provider => [VIEW,USE,MOD,CRE,VPRM,GPRM], ProviderAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], HardwareProfile => [VIEW, MOD,CRE,VPRM,GPRM], diff --git a/src/lib/tasks/dc_tasks.rake b/src/lib/tasks/dc_tasks.rake index 7c0a297..083e3e8 100644 --- a/src/lib/tasks/dc_tasks.rake +++ b/src/lib/tasks/dc_tasks.rake @@ -164,6 +164,22 @@ namespace :dc do
end
+ desc 'Data upgrade for conductor' + # this should eventually be pulled out into a separate "upgrade everything in here" directory + task :upgrade => :environment do + Role.transaction do + image_admin_role = Role.find_by_name("base.image.admin") + if image_admin_role and image_admin_role.privileges. + where(:target_type => "ProviderAccount").empty? + ["view", "use"].each do |action| + Privilege.create!(:role => image_admin_role, + :target_type => "ProviderAccount", + :action => action) + end + end + end + end + def get_account(provider_name, account_name) unless provider = Provider.find_by_name(provider_name) raise "There is no provider with '#{provider_name}' name"
On Tuesday 29 May 2012 14:24:40 Scott Seago wrote:
https://bugzilla.redhat.com/show_bug.cgi?id= 807745
Image admin role has been augmented to include view and use permissions on provider accounts. This allows global image admins to import images from any provider account.
To see the changes you need to run 'rake dc:upgrade' which performs the necessary data upgrade to get the role modification. The upgrade is currently implemented inline in the rake task -- the intent is for this task to eventually run a set of upgrade scripts from a dedicated 'upgrades' directory, but the infrastructure for that is not yet set up.
src/db/seeds.rb | 3 ++- src/lib/tasks/dc_tasks.rake | 16 ++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletions(-)
diff --git a/src/db/seeds.rb b/src/db/seeds.rb index 71b4f62..529ad76 100644 --- a/src/db/seeds.rb +++ b/src/db/seeds.rb @@ -112,7 +112,8 @@ roles = Quota => [VIEW]}], "base.image.admin" => [false, {PoolFamily => [VIEW, USE], Catalog => [VIEW,USE,MOD,CRE,VPRM,GPRM], - Deployable => [VIEW,USE,MOD,CRE,VPRM,GPRM]}], + Deployable => [VIEW,USE,MOD,CRE,VPRM,GPRM], + ProviderAccount => [VIEW,USE]}], "base.admin" => [false, {Provider => [VIEW,USE,MOD,CRE,VPRM,GPRM], ProviderAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], HardwareProfile => [VIEW, MOD,CRE,VPRM,GPRM], diff --git a/src/lib/tasks/dc_tasks.rake b/src/lib/tasks/dc_tasks.rake index 7c0a297..083e3e8 100644 --- a/src/lib/tasks/dc_tasks.rake +++ b/src/lib/tasks/dc_tasks.rake @@ -164,6 +164,22 @@ namespace :dc do
end
- desc 'Data upgrade for conductor'
- # this should eventually be pulled out into a separate "upgrade
everything in here" directory + task :upgrade => :environment do
- Role.transaction do
image_admin_role = Role.find_by_name("base.image.admin")
if image_admin_role and image_admin_role.privileges.
where(:target_type => "ProviderAccount").empty?
["view", "use"].each do |action|
Privilege.create!(:role => image_admin_role,
:target_type => "ProviderAccount",
:action => action)
end
end
- end
- end
- def get_account(provider_name, account_name) unless provider = Provider.find_by_name(provider_name) raise "There is no provider with '#{provider_name}' name"
ACK, it's fixing the issue according to related BZ discussion.
aeolus-devel@lists.fedorahosted.org