mirror of
https://github.com/vatesfr/xen-orchestra.git
synced 2026-09-10 22:14:48 -05:00
feat(acl): add Network administrator built-in role template (#9952)
This commit is contained in:
Mathieu
@@ -50,6 +50,7 @@
|
||||
- [XO6/VDI] Update actions name to be more consistent (PR [#9968](https://github.com/vatesfr/xen-orchestra/pull/9968))
|
||||
- [SR] Storage repositories can now be deleted from the Pool/Host Storage tab (PR [#9853](https://github.com/vatesfr/xen-orchestra/pull/9853))
|
||||
- [SR] Storage repositories can now be disconnected from the Pool/Host Storage tab (PR [#9856](https://github.com/vatesfr/xen-orchestra/pull/9856))
|
||||
- [REST API/RBAC] Add a built-in **Network administrator** role template: manage networks and VIFs, read and update PIFs (PR [#9952](https://github.com/vatesfr/xen-orchestra/pull/9952))
|
||||
|
||||
### Bug fixes
|
||||
|
||||
|
||||
@@ -63,7 +63,7 @@ The reverse is not true: granting `shutdown:clean` does **not** grant `shutdown:
|
||||
|
||||
## Built-in template roles
|
||||
|
||||
Xen Orchestra ships with four ready-to-use role templates. They are **immutable** and automatically kept up to date on startup — they cannot be modified, deleted, or assigned directly.
|
||||
Xen Orchestra ships with six ready-to-use role templates. They are **immutable** and automatically kept up to date on startup — they cannot be modified, deleted, or assigned directly.
|
||||
|
||||
To use them, **copy** a template into a new role and assign that copy to your users or groups. This ensures the built-in templates always stay up to date without affecting your custom configuration.
|
||||
|
||||
@@ -74,6 +74,7 @@ To use them, **copy** a template into a new role and assign that copy to your us
|
||||
| **VMs creator** | Can instantiate VM templates and create VDIs and VIFs. |
|
||||
| **VMs read only** | Can only list and view VMs. |
|
||||
| **VMs administrator** | Full control over VM actions |
|
||||
| **Network administrator** | Can manage networks and VIFs, read and update PIFs, and view hosts and VMs. |
|
||||
|
||||
|
||||
|
||||
@@ -104,30 +105,30 @@ Actions are written using the exact string you pass in a privilege. A parent act
|
||||
|
||||
### Infrastructure resources
|
||||
|
||||
| Resource | Available actions |
|
||||
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
|
||||
| Resource | Available actions |
|
||||
| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
||||
| `vm` | `read`, `clone`, `delete`, `migrate-send`, `export`, `pause`, `start`, `resume`, `revert-snapshot`, `snapshot`, `suspend`, `unpause`, `reboot:clean`, `reboot:hard`, `shutdown:clean`, `shutdown:hard`, `update:affinityHost`, `update:autoPoweron`, `update:blockedOperations`, `update:coresPerSocket`, `update:cpuCap`, `update:cpuMask`, `update:cpuWeight`, `update:cpus`, `update:cpusStaticMax`, `update:creation`, `update:datasources`, `update:expNestedHvm`, `update:hasVendorDevice`, `update:highAvailability`, `update:hvmBootFirmware`, `update:memory`, `update:memoryMax`, `update:memoryMin`, `update:memoryStaticMax`, `update:nameDescription`, `update:nameLabel`, `update:nestedVirt`, `update:nicType`, `update:notes`, `update:PV_args`, `update:resourceSet`, `update:secureBoot`, `update:share`, `update:startDelay`, `update:suspendSr`, `update:tags`, `update:uefiMode`, `update:vga`, `update:videoram`, `update:viridian`, `update:virtualizationMode`, `update:xenStoreData` |
|
||||
| `vm-snapshot` | `read`, `delete`, `export`, `update:tags` |
|
||||
| `vm-template` | `read`, `delete`, `export`, `instantiate`, `update:tags` |
|
||||
| `vm-controller` | `read`, `update:tags` |
|
||||
| `vdi` | `read`, `create`, `delete`, `boot`, `export-content`, `import-content`, `migrate-send`, `update:tags` |
|
||||
| `vdi-snapshot` | `read`, `delete`, `export`, `update:tags` |
|
||||
| `vdi-unmanaged` | `read` |
|
||||
| `vif` | `connect`, `create`, `delete`, `disconnect`,`read` |
|
||||
| `vbd` | `read`, `create`, `delete`, `connect`, `disconnect` |
|
||||
| `sr` | `read`, `delete`, `forget`, `migrate-receive`, `reclaim-space`, `scan`, `import:vdi`, `import:vm`, `update:tags` |
|
||||
| `host` | `read`, `allow-vm`, `join-pool`, `export:logs`,`migrate-receive`, `update:tags`, `disable`, `enable`, `evacuate` |
|
||||
| `pool` | `add-host`, `read`, `emergency-shutdown`, `rolling-reboot`, `rolling-update`, `create:network`, `create:vm`, `update:tags` |
|
||||
| `network` | `read`, `create`, `delete`, `update:tags` |
|
||||
| `pif` | `read`, `update:management` |
|
||||
| `pbd` | `read`, `plug`, `unplug` |
|
||||
| `pci` | `read` |
|
||||
| `pgpu` | `read` |
|
||||
| `vgpu` | `read` |
|
||||
| `vgpuType` | `read` |
|
||||
| `vtpm` | `read` |
|
||||
| `sm` | `read` |
|
||||
| `gpuGroup` | `read` |
|
||||
| `vm-snapshot` | `read`, `delete`, `export`, `update:tags` |
|
||||
| `vm-template` | `read`, `delete`, `export`, `instantiate`, `update:tags` |
|
||||
| `vm-controller` | `read`, `update:tags` |
|
||||
| `vdi` | `read`, `create`, `delete`, `boot`, `export-content`, `import-content`, `migrate-send`, `update:tags` |
|
||||
| `vdi-snapshot` | `read`, `delete`, `export`, `update:tags` |
|
||||
| `vdi-unmanaged` | `read` |
|
||||
| `vif` | `connect`, `create`, `delete`, `disconnect`,`read` |
|
||||
| `vbd` | `read`, `create`, `delete`, `connect`, `disconnect` |
|
||||
| `sr` | `read`, `delete`, `forget`, `migrate-receive`, `reclaim-space`, `scan`, `import:vdi`, `import:vm`, `update:tags` |
|
||||
| `host` | `read`, `allow-vm`, `join-pool`, `export:logs`,`migrate-receive`, `update:tags`, `disable`, `enable`, `evacuate` |
|
||||
| `pool` | `add-host`, `read`, `emergency-shutdown`, `rolling-reboot`, `rolling-update`, `create:network`, `create:vm`, `update:tags` |
|
||||
| `network` | `read`, `create`, `delete`, `update:tags` |
|
||||
| `pif` | `read`, `update:management` |
|
||||
| `pbd` | `read`, `plug`, `unplug` |
|
||||
| `pci` | `read` |
|
||||
| `pgpu` | `read` |
|
||||
| `vgpu` | `read` |
|
||||
| `vgpuType` | `read` |
|
||||
| `vtpm` | `read` |
|
||||
| `sm` | `read` |
|
||||
| `gpuGroup` | `read` |
|
||||
|
||||
### XO management resources
|
||||
|
||||
|
||||
@@ -10,6 +10,7 @@ import {
|
||||
VMS_POWER_STATE_MANAGER,
|
||||
VMS_READ_ONLY,
|
||||
VMS_ADMINISTRATOR,
|
||||
NETWORK_ADMINISTRATOR,
|
||||
} from './template-roles.mjs'
|
||||
|
||||
import { Roles } from '../../models/acls-v2/role.mjs'
|
||||
@@ -57,6 +58,7 @@ const TEMPLATE_ROLES = [
|
||||
/** @type {RoleTemplate} */ (VMS_CREATOR),
|
||||
/** @type {RoleTemplate} */ (VMS_READ_ONLY),
|
||||
/** @type {RoleTemplate} */ (VMS_ADMINISTRATOR),
|
||||
/** @type {RoleTemplate} */ (NETWORK_ADMINISTRATOR),
|
||||
]
|
||||
|
||||
export default class {
|
||||
|
||||
@@ -93,3 +93,20 @@ export const VMS_ADMINISTRATOR = {
|
||||
{ action: 'read', resource: 'vm-snapshot', effect: 'allow' },
|
||||
],
|
||||
}
|
||||
|
||||
// === Network
|
||||
export const NETWORK_ADMINISTRATOR = {
|
||||
roleTemplateId: 6,
|
||||
name: 'Network administrator',
|
||||
description: 'Manage networks across pools, hosts and VMs',
|
||||
privileges: [
|
||||
{ action: '*', resource: 'network', effect: 'allow' },
|
||||
{ action: 'create:network', resource: 'pool', effect: 'allow' },
|
||||
{ action: 'read', resource: 'pool', effect: 'allow' },
|
||||
{ action: 'read', resource: 'pif', effect: 'allow' },
|
||||
{ action: 'update', resource: 'pif', effect: 'allow' },
|
||||
{ action: '*', resource: 'vif', effect: 'allow' },
|
||||
{ action: 'read', resource: 'host', effect: 'allow' },
|
||||
{ action: 'read', resource: 'vm', effect: 'allow' },
|
||||
],
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user