----- Original Message -----
From: "Dan Callaghan" dcallagh@redhat.com To: "beaker-devel" beaker-devel@lists.fedorahosted.org Sent: Friday, February 13, 2015 3:28:05 PM Subject: Re: [Beaker-devel] Design proposal: Predefined Access Policies for Systems
Excerpts from Amit Saha's message of 2015-02-06 12:12 +10:00:
We just published the design proposal for implementing "Predefined access policies for systems" [1].
If you have any questions/comments/suggestions, please do let us know.
[1] https://beaker-project.org/dev/proposals/predefined-access-policies.html
This looks good overall, there is just a few bits of the CLI that don't quite make sense.
Create an access policy for a pool with a single rule: bkr pool-policy-create --pool=<poolname> \ --permission=reserve --group=qeteam Remove the pool policy: bkr pool-policy-remove --pool=<poolname>
Neither of these should be necessary. A pool will always have a policy associated with it. Removing the policy from a pool doesn't make sense, and creating the policy for a pool should not be an explicit step.
The actual adding/removing of rules should use the existing bkr policy-grant/policy-revoke commands, which will need to be extended to accept a new option --pool instead of --fqdn.
Through the bkr cli: bkr policy-grant --system=test1.example.com --pool-policy <poolname> The system will now use the access policy defined by the pool. Note that this will not a custom access policy that may already exist for the system. It will just not be applicable.
policy-grant is the wrong subcommand for this. bkr policy-grant is for adding rules to a policy, but the operation here is setting the policy for a system. So it should be a new option --pool-policy=<poolname> on bkr system-modify.
Similarly "revoking a pool policy" doesn't make sense, the operation is actually setting the system to use a custom policy. So this should also be an option on bkr system-modify. Either --pool-policy='' which is a bit awkward, or else a separate mutually exclusive option like --use-custom-policy.
Thanks for the comments.
I updated the proposal: http://gerrit.beaker-project.org/#/c/3987/1