Excerpts from Nick Coghlan's message of 2015-02-16 18:30 +10:00:
On 02/16/2015 06:09 PM, Amit Saha wrote:
> For the use case that a pool owner creates a pool, adds systems to
> it and wants to use the same pool policy across systems - your
> suggestion is perfect. What if I want to
> make use of a random pool's access policy because I just happen to
> find my requirements are
> identical but I do not/cannot add my system to the pool?
Then I'd tell you that's a bad idea because you have no idea how that
pool's policy is going to evolve in the future. It may meet your needs
today, but what about tomorrow? Next week? Next year?
Allowing a system owner to use a pool policy without their system being
part of the relevant pool now strikes me as a genuinely *bad* idea,
since it creates a dependency without a mutual agreement between the two
parties, so the pool owner may change their ACLs without even
considering the possible implications for systems outside the pool that
may be using that ACL.
Yes I agree, the system should only be able to use the policy from
a pool which it is a member of, not any arbitrary pool. It keeps the UI
simpler too (a select rather than a typeahead).
Something this does suggest to me is that it should be possible to
have
"open pools", where everyone with an account on the Beaker instance is
able to add their systems. In access policy rules, I believe "Everybody"
is indicated by having both the group and the user be NULL - perhaps the
same semantics could be used for the pool owner? (i.e. a pool without
any specifically designated owner is an "open pool" where everyone with
system policy management access can add and remove their own systems
from that pool)
I think it's also a valid use case for being able to clone an existing
policy from an arbitrary pool when creating a new pool.
Yes these are both interesting RFEs (open pools and copying policies)
but let's leave them out of this first iteration.
--
Dan Callaghan <dcallagh(a)redhat.com>
Software Engineer, Hosted & Shared Services
Red Hat, Inc.