[IA-5060] Inherit manager roles to notebook-cluster and persistent-disk #1535
Conversation
| } | ||
| persistent-disk = { | ||
| actionPatterns = { | ||
| read = { | ||
| description = "read metadata and contents of persistent disk" | ||
| description = "read metadata of persistent disk" |
There was a problem hiding this comment.
read is just used for listing disks; attach is needed to actually view the contents of a disk
rtitle
changed the title
| @@ -790,6 +800,7 @@ resourceTypes = { | |||
| } | |||
| connect = { | |||
| description = "connect to the Jupyter notebook running on the notebook cluster" | |||
| authDomainConstrainable = true | |||
There was a problem hiding this comment.
I am a bit confused about how granular the authDomainConstrainable is here. I thought that every resources / actions would inherit that configuration from the workspace after Doug's PR
There was a problem hiding this comment.
My understanding was you still have to annotate which actions on the child are authDomainConstrainable (like connect). @dvoet can you confirm?
There was a problem hiding this comment.
@rtitle is correct. The auth domain is inherited but which actions have the auth domain applied is controlled by the authDomainConstrainable setting.
|
VERY draft Leo PR to start creating Sam resources with parents (phase 2): DataBiosphere/leonardo#4781 I'll try to test these together next week. |
rtitle
changed the title
rtitle
changed the title
rtitle
force-pushed
the
rt-leo-access-control
branch
from
1fa9961
to
f73189f
Compare
|
|
@LizBaldo requested review on this PR. I tested on a BEE and verified that all the resources (runtime, disk, app) continue to work normally. |
|
@rtitle or anyone here - Is the failure in |
|
@ungwudik I noticed that, the Orch test failed with: Looks like the Orch swat test failed to get a dev shibboleth endpoint. This PR didn't touch anything related to orch/shibboleth. I'm not sure if this is a known dev infra issue? (cc @tlangs) |
Ticket: https://broadworkbench.atlassian.net/browse/IA-5060
What:
Phase 1 of the Simplify Leo Access Control epic.
This PR:
notebook-clusterandperstistent-diskresource types to inherit fromgoogle-projector workspace.notebook-cluster/connectandpersistent-disk/attachactions auth domain constrainable.Why:
We are trying to clean up/simplify Leonardo access control logic. Part of this is standardizing on consistent Sam resource types and using inheritance to propagate permissions. This PR sets up the Sam model; subsequent Leonardo changes will be made to migrate to it.
PR checklist