https://bugzilla.redhat.com/show_bug.cgi?id= 807745
Image admin role has been augmented to include view and use permissions
on provider accounts. This allows global image admins to import
images from any provider account.
To see the changes you need to run 'rake dc:upgrade' which performs the
necessary data upgrade to get the role modification. The upgrade is
currently implemented inline in the rake task -- the intent is
for this task to eventually run a set of upgrade scripts from a
dedicated 'upgrades' directory, but the infrastructure for that is not
yet set up.
---
src/db/seeds.rb | 3 ++-
src/lib/tasks/dc_tasks.rake | 16 ++++++++++++++++
2 files changed, 18 insertions(+), 1 deletions(-)
diff --git a/src/db/seeds.rb b/src/db/seeds.rb
index 71b4f62..529ad76 100644
--- a/src/db/seeds.rb
+++ b/src/db/seeds.rb
@@ -112,7 +112,8 @@ roles =
Quota => [VIEW]}],
"base.image.admin" => [false, {PoolFamily => [VIEW,
USE],
Catalog =>
[VIEW,USE,MOD,CRE,VPRM,GPRM],
- Deployable =>
[VIEW,USE,MOD,CRE,VPRM,GPRM]}],
+ Deployable =>
[VIEW,USE,MOD,CRE,VPRM,GPRM],
+ ProviderAccount => [VIEW,USE]}],
"base.admin" => [false, {Provider =>
[VIEW,USE,MOD,CRE,VPRM,GPRM],
ProviderAccount =>
[VIEW,USE,MOD,CRE,VPRM,GPRM],
HardwareProfile => [VIEW,
MOD,CRE,VPRM,GPRM],
diff --git a/src/lib/tasks/dc_tasks.rake b/src/lib/tasks/dc_tasks.rake
index 7c0a297..083e3e8 100644
--- a/src/lib/tasks/dc_tasks.rake
+++ b/src/lib/tasks/dc_tasks.rake
@@ -164,6 +164,22 @@ namespace :dc do
end
+ desc 'Data upgrade for conductor'
+ # this should eventually be pulled out into a separate "upgrade everything in
here" directory
+ task :upgrade => :environment do
+ Role.transaction do
+ image_admin_role = Role.find_by_name("base.image.admin")
+ if image_admin_role and image_admin_role.privileges.
+ where(:target_type => "ProviderAccount").empty?
+ ["view", "use"].each do |action|
+ Privilege.create!(:role => image_admin_role,
+ :target_type => "ProviderAccount",
+ :action => action)
+ end
+ end
+ end
+ end
+
def get_account(provider_name, account_name)
unless provider = Provider.find_by_name(provider_name)
raise "There is no provider with '#{provider_name}' name"
--
1.7.6.5