[Engine-devel] Managing permissions on network

[Livnat Peer]

Hi All,

This is a proposal for handling network permissions in oVirt.

In this proposal we took the more permissive approach as we find it
simple and a good starting point, we also think a more restrict approach
makes the configuration of a network cumbersome for ovirt administrators.

Inputs are welcomed as always...

Here is an overview of the approach, for more detailed description
please read the wiki page:
http://wiki.ovirt.org/wiki/Feature/NetworkPermissions

---------------------------------------------------------------------------
Admin
======

-> For creating a network in a data center you need to be a Superuser or
a DCAdmin or a networkAdmin on the DC.

-> After creating the network you can manipulate the network if you are
a DCAdmin or a networkAdmin on the relevant network (or the whole DC).

-> For attaching the network to cluster you need to be a networkAdmin on
the network (no requirement to have permission on the cluster)

-> Cluster administrator can not attach/detach a network from the
cluster, the motivation for this is that as long as the network is not
attached to the cluster it is not part of the cluster resources thus can
not be managed by the cluster administrator.
In addition once a network is attached to a cluster the cluster
administrator can change the network from required to non-required for
controlling the impact of the network within the cluster.

-> For setting a network on the host you need to be host administrator
on the host and you don't need to be network administrator.
This implies that if you are a host administrator you can add/remove all
the cluster networks from your host without the need for network related
permissions (this is the permissive approach).

User
====

-> For attaching a network to a Vnic in the VM you need to have the role
of VmNetworkUser on the network and vmAdmin on the VM.

-> In user portal - the list of shown network for a user will include
only the list of networks the user is allowed to attach to its vnics
(instead of all cluster's networks).

Port-mirroring
===============

->  For configuring in the VM port mirroring you need to have the role
of VmAdvancedNetworkUser on the network and vmAdmin on the VM.
VmAdvancedNetworkUser includes the VmNetworkUser actions in addition to
port mirroring.




For all DB upgrade information and new roles/action groups please review
the wiki.

Thanks,
Livnat & Moti