diff --git a/CHANGELOG.unreleased.md b/CHANGELOG.unreleased.md index 9441fc0272..42e7d7a0eb 100644 --- a/CHANGELOG.unreleased.md +++ b/CHANGELOG.unreleased.md @@ -50,6 +50,7 @@ - [XO6/VDI] Update actions name to be more consistent (PR [#9968](https://github.com/vatesfr/xen-orchestra/pull/9968)) - [SR] Storage repositories can now be deleted from the Pool/Host Storage tab (PR [#9853](https://github.com/vatesfr/xen-orchestra/pull/9853)) - [SR] Storage repositories can now be disconnected from the Pool/Host Storage tab (PR [#9856](https://github.com/vatesfr/xen-orchestra/pull/9856)) +- [REST API/RBAC] Add a built-in **Network administrator** role template: manage networks and VIFs, read and update PIFs (PR [#9952](https://github.com/vatesfr/xen-orchestra/pull/9952)) ### Bug fixes diff --git a/docs/docs/xo6/acl-v2.md b/docs/docs/xo6/acl-v2.md index 983c4f1f5a..600c3cafd7 100644 --- a/docs/docs/xo6/acl-v2.md +++ b/docs/docs/xo6/acl-v2.md @@ -63,7 +63,7 @@ The reverse is not true: granting `shutdown:clean` does **not** grant `shutdown: ## Built-in template roles -Xen Orchestra ships with four ready-to-use role templates. They are **immutable** and automatically kept up to date on startup — they cannot be modified, deleted, or assigned directly. +Xen Orchestra ships with six ready-to-use role templates. They are **immutable** and automatically kept up to date on startup — they cannot be modified, deleted, or assigned directly. To use them, **copy** a template into a new role and assign that copy to your users or groups. This ensures the built-in templates always stay up to date without affecting your custom configuration. @@ -74,6 +74,7 @@ To use them, **copy** a template into a new role and assign that copy to your us | **VMs creator** | Can instantiate VM templates and create VDIs and VIFs. | | **VMs read only** | Can only list and view VMs. | | **VMs administrator** | Full control over VM actions | +| **Network administrator** | Can manage networks and VIFs, read and update PIFs, and view hosts and VMs. | ![acl-role copy documented in Swagger](../assets/swagger-role-copy.png) @@ -104,30 +105,30 @@ Actions are written using the exact string you pass in a privilege. A parent act ### Infrastructure resources -| Resource | Available actions | -| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Resource | Available actions | +| --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `vm` | `read`, `clone`, `delete`, `migrate-send`, `export`, `pause`, `start`, `resume`, `revert-snapshot`, `snapshot`, `suspend`, `unpause`, `reboot:clean`, `reboot:hard`, `shutdown:clean`, `shutdown:hard`, `update:affinityHost`, `update:autoPoweron`, `update:blockedOperations`, `update:coresPerSocket`, `update:cpuCap`, `update:cpuMask`, `update:cpuWeight`, `update:cpus`, `update:cpusStaticMax`, `update:creation`, `update:datasources`, `update:expNestedHvm`, `update:hasVendorDevice`, `update:highAvailability`, `update:hvmBootFirmware`, `update:memory`, `update:memoryMax`, `update:memoryMin`, `update:memoryStaticMax`, `update:nameDescription`, `update:nameLabel`, `update:nestedVirt`, `update:nicType`, `update:notes`, `update:PV_args`, `update:resourceSet`, `update:secureBoot`, `update:share`, `update:startDelay`, `update:suspendSr`, `update:tags`, `update:uefiMode`, `update:vga`, `update:videoram`, `update:viridian`, `update:virtualizationMode`, `update:xenStoreData` | -| `vm-snapshot` | `read`, `delete`, `export`, `update:tags` | -| `vm-template` | `read`, `delete`, `export`, `instantiate`, `update:tags` | -| `vm-controller` | `read`, `update:tags` | -| `vdi` | `read`, `create`, `delete`, `boot`, `export-content`, `import-content`, `migrate-send`, `update:tags` | -| `vdi-snapshot` | `read`, `delete`, `export`, `update:tags` | -| `vdi-unmanaged` | `read` | -| `vif` | `connect`, `create`, `delete`, `disconnect`,`read` | -| `vbd` | `read`, `create`, `delete`, `connect`, `disconnect` | -| `sr` | `read`, `delete`, `forget`, `migrate-receive`, `reclaim-space`, `scan`, `import:vdi`, `import:vm`, `update:tags` | -| `host` | `read`, `allow-vm`, `join-pool`, `export:logs`,`migrate-receive`, `update:tags`, `disable`, `enable`, `evacuate` | -| `pool` | `add-host`, `read`, `emergency-shutdown`, `rolling-reboot`, `rolling-update`, `create:network`, `create:vm`, `update:tags` | -| `network` | `read`, `create`, `delete`, `update:tags` | -| `pif` | `read`, `update:management` | -| `pbd` | `read`, `plug`, `unplug` | -| `pci` | `read` | -| `pgpu` | `read` | -| `vgpu` | `read` | -| `vgpuType` | `read` | -| `vtpm` | `read` | -| `sm` | `read` | -| `gpuGroup` | `read` | +| `vm-snapshot` | `read`, `delete`, `export`, `update:tags` | +| `vm-template` | `read`, `delete`, `export`, `instantiate`, `update:tags` | +| `vm-controller` | `read`, `update:tags` | +| `vdi` | `read`, `create`, `delete`, `boot`, `export-content`, `import-content`, `migrate-send`, `update:tags` | +| `vdi-snapshot` | `read`, `delete`, `export`, `update:tags` | +| `vdi-unmanaged` | `read` | +| `vif` | `connect`, `create`, `delete`, `disconnect`,`read` | +| `vbd` | `read`, `create`, `delete`, `connect`, `disconnect` | +| `sr` | `read`, `delete`, `forget`, `migrate-receive`, `reclaim-space`, `scan`, `import:vdi`, `import:vm`, `update:tags` | +| `host` | `read`, `allow-vm`, `join-pool`, `export:logs`,`migrate-receive`, `update:tags`, `disable`, `enable`, `evacuate` | +| `pool` | `add-host`, `read`, `emergency-shutdown`, `rolling-reboot`, `rolling-update`, `create:network`, `create:vm`, `update:tags` | +| `network` | `read`, `create`, `delete`, `update:tags` | +| `pif` | `read`, `update:management` | +| `pbd` | `read`, `plug`, `unplug` | +| `pci` | `read` | +| `pgpu` | `read` | +| `vgpu` | `read` | +| `vgpuType` | `read` | +| `vtpm` | `read` | +| `sm` | `read` | +| `gpuGroup` | `read` | ### XO management resources diff --git a/packages/xo-server/src/xo-mixins/acls-v2/index.mjs b/packages/xo-server/src/xo-mixins/acls-v2/index.mjs index 15bfd44344..3723d54152 100644 --- a/packages/xo-server/src/xo-mixins/acls-v2/index.mjs +++ b/packages/xo-server/src/xo-mixins/acls-v2/index.mjs @@ -10,6 +10,7 @@ import { VMS_POWER_STATE_MANAGER, VMS_READ_ONLY, VMS_ADMINISTRATOR, + NETWORK_ADMINISTRATOR, } from './template-roles.mjs' import { Roles } from '../../models/acls-v2/role.mjs' @@ -57,6 +58,7 @@ const TEMPLATE_ROLES = [ /** @type {RoleTemplate} */ (VMS_CREATOR), /** @type {RoleTemplate} */ (VMS_READ_ONLY), /** @type {RoleTemplate} */ (VMS_ADMINISTRATOR), + /** @type {RoleTemplate} */ (NETWORK_ADMINISTRATOR), ] export default class { diff --git a/packages/xo-server/src/xo-mixins/acls-v2/template-roles.mjs b/packages/xo-server/src/xo-mixins/acls-v2/template-roles.mjs index 0233bd444f..3be87ad83b 100644 --- a/packages/xo-server/src/xo-mixins/acls-v2/template-roles.mjs +++ b/packages/xo-server/src/xo-mixins/acls-v2/template-roles.mjs @@ -93,3 +93,20 @@ export const VMS_ADMINISTRATOR = { { action: 'read', resource: 'vm-snapshot', effect: 'allow' }, ], } + +// === Network +export const NETWORK_ADMINISTRATOR = { + roleTemplateId: 6, + name: 'Network administrator', + description: 'Manage networks across pools, hosts and VMs', + privileges: [ + { action: '*', resource: 'network', effect: 'allow' }, + { action: 'create:network', resource: 'pool', effect: 'allow' }, + { action: 'read', resource: 'pool', effect: 'allow' }, + { action: 'read', resource: 'pif', effect: 'allow' }, + { action: 'update', resource: 'pif', effect: 'allow' }, + { action: '*', resource: 'vif', effect: 'allow' }, + { action: 'read', resource: 'host', effect: 'allow' }, + { action: 'read', resource: 'vm', effect: 'allow' }, + ], +}