Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
controller: add allow-model-access flag #6427
Conversation
| // If we have a remote user which has explict model access, but no | ||
| - // controller access, nor no 'everyone' access, the user has no access. | ||
| + // controller access, nor no 'everyone' access, the user will have access |
| @@ -284,6 +298,7 @@ var configChecker = schema.FieldMap(schema.Fields{ | ||
| SetNUMAControlPolicyKey: schema.Bool(), | ||
| AutocertURLKey: schema.String(), | ||
| AutocertDNSNameKey: schema.String(), | ||
| + AllowModelAccessKey: schema.Bool(), |
|
QA OK $$merge$$ |
|
Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju |
|
Build failed: Tests failed |
AlexisBruemmer
commented
Oct 11, 2016
|
$$merge$$ |
|
Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju |
jujubot
merged commit 9e55fbb
into
juju:master
Oct 11, 2016
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
rogpeppe commentedOct 11, 2016
•
Edited 1 time
-
rogpeppe
Oct 11, 2016
This allows model users access to a model they've been granted
access to without the requirement for them to have access
to the controller too.
This required the ability for some apiserver tests to be able
to start the API server with a custom configuration, which
required some changes in the apiserver tests. Specifically
we consolidate the API server test starting code into
one place and use it throughout.
We also rename permission.UndefinedAccess to permission.NoAccess
because that's what it actually implies (note that although the
comment on UndefinedAccess states that it's an invalid
permission, Access.Validate begs to differ as do a fair number
of other places that rely on UndefinedAccess meaning
"no permissions").
Fixes https://bugs.launchpad.net/juju/+bug/1631449.
QA instructions
bootstrap a controller:
juju bootstrap --config identity-url=https://api.jujucharms.com/identity --config allow-model-access=true
create a model and grant access to an external user on that model
check that that user can access the model and that they cannot list models in the controller or do anything else that requires a controller-level API connection.