Page MenuHomePhabricator

Investigate, adjust default access policies for Trove and trove-dashboard
Closed, ResolvedPublic

Description

  • make sure that instance creation/manipulation is restricted to projectadmins
  • make sure trove-dashboard displays the appropriate panels based on user role

Some of this might require upstream patches; it's not clear to me that Trove uses the shared oslo policy code correctly.

Event Timeline

Change 684136 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] Trove: add policy.yaml override

https://gerrit.wikimedia.org/r/684136

Change 684136 merged by Andrew Bogott:

[operations/puppet@production] Trove: add policy.yaml override

https://gerrit.wikimedia.org/r/684136

Change 684137 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] Horizon: install trove policy file for trove-dashboard

https://gerrit.wikimedia.org/r/684137

Change 684137 merged by Andrew Bogott:

[operations/puppet@production] Horizon: install trove policy file for trove-dashboard

https://gerrit.wikimedia.org/r/684137

Change 684494 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] wmcs-policy-tests.py: add Trove policy tests

https://gerrit.wikimedia.org/r/684494

Change 685105 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] trove.conf: use our custom policy.yaml

https://gerrit.wikimedia.org/r/685105

Change 684494 merged by Andrew Bogott:

[operations/puppet@production] wmcs-policy-tests.py: add Trove policy tests

https://gerrit.wikimedia.org/r/684494

Change 685105 merged by Andrew Bogott:

[operations/puppet@production] trove.conf: use our custom policy.yaml

https://gerrit.wikimedia.org/r/685105

Change 685157 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[operations/puppet@production] Horizon local_settings: fix name of trove policy setting

https://gerrit.wikimedia.org/r/685157

Change 685157 merged by Andrew Bogott:

[operations/puppet@production] Horizon local_settings: fix name of trove policy setting

https://gerrit.wikimedia.org/r/685157

aborrero triaged this task as Medium priority.May 11 2021, 4:11 PM
aborrero moved this task from Inbox to Doing on the cloud-services-team (Kanban) board.

Change 689181 had a related patch set uploaded (by Andrew Bogott; author: Andrew Bogott):

[openstack/horizon/deploy@main] Update and install default policies for designate and trove dashboards

https://gerrit.wikimedia.org/r/689181

Change 689181 merged by Andrew Bogott:

[openstack/horizon/deploy@main] Update and install default policies for designate and trove dashboards

https://gerrit.wikimedia.org/r/689181

This is resolved in our release. The upstream dashboard policies are in limbo because there's an unresolved controversy about how to include default policies in Horizon dashboards (I have an opinion but am tired of arguing.)

https://review.opendev.org/c/openstack/trove-dashboard/+/790137

@Andrew: Per emails from Sep18 and Oct20 and https://www.mediawiki.org/wiki/Bug_management/Assignee_cleanup , I am resetting the assignee of this task because there has not been progress lately (please correct me if I am wrong!). Resetting the assignee avoids the impression that somebody is already working on this task. It also allows others to potentially work towards fixing this task. Please claim this task again when you plan to work on it (via Add Action...Assign / Claim in the dropdown menu) - it would be welcome. Thanks for your understanding!

Andrew claimed this task.