From: "Dan Callaghan" <dcallagh(a)redhat.com>
To: "beaker-devel" <beaker-devel(a)lists.fedorahosted.org>
Sent: Friday, February 13, 2015 3:28:05 PM
Subject: Re: [Beaker-devel] Design proposal: Predefined Access Policies for Systems
Excerpts from Amit Saha's message of 2015-02-06 12:12 +10:00:
> We just published the design proposal for implementing "Predefined
> access policies for systems" [1].
>
> If you have any questions/comments/suggestions, please do let us know.
>
> [1]
>
https://beaker-project.org/dev/proposals/predefined-access-policies.html
This looks good overall, there is just a few bits of the CLI that don't
quite make sense.
Create an access policy for a pool with a single rule:
bkr pool-policy-create --pool=<poolname> \
--permission=reserve --group=qeteam
Remove the pool policy:
bkr pool-policy-remove --pool=<poolname>
Neither of these should be necessary. A pool will always have a policy
associated with it. Removing the policy from a pool doesn't make sense,
and creating the policy for a pool should not be an explicit step.
The actual adding/removing of rules should use the existing bkr
policy-grant/policy-revoke commands, which will need to be extended to
accept a new option --pool instead of --fqdn.
Through the bkr cli:
bkr policy-grant --system=test1.example.com --pool-policy
<poolname>
The system will now use the access policy defined by the pool. Note that
this will not a custom access policy that may already exist for the
system. It will just not be applicable.
policy-grant is the wrong subcommand for this. bkr policy-grant is for
adding rules to a policy, but the operation here is setting the policy
for a system. So it should be a new option --pool-policy=<poolname> on
bkr system-modify.
Similarly "revoking a pool policy" doesn't make sense, the operation is
actually setting the system to use a custom policy. So this should also
be an option on bkr system-modify. Either --pool-policy='' which is
a bit awkward, or else a separate mutually exclusive option like
--use-custom-policy.