Adding RBAC (Role Based Access Control) support to pulp_deb

[pulpbot]

Author: @quba42 (quba42)

Redmine Issue: 7315, https://pulp.plan.io/issues/7315

---

pulpcore 3.6 adds experimental RBAC support. This may be declared safe to use with pulpcore 3.7.

Plugins can start taking advantage of this feature at their own choosing.

Plugin writers doc:

https://github.com/pulp/pulpcore/tree/master/docs/plugins/plugin-writer/concepts/rbac

[stale]

This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution!

[cleonn]

At Linkoping University we are using pulp2 and are currently working on migrating to pulp3. This is a must have for us to fully decommission pulp2! Can we have it? :) We really need feature parity with pulp_rpm with regard to rbac. (There will probably be Swedish Candy for the fixer!)

[stale]

This issue is no longer marked for closure.

[quba42]

@cleonn We currently have no plans/capacity to work on RBAC. I also don't have a clear conception what this entails. Given you seem to have some conception of "RBAC feature parity with pulp_rpm", would you (or anyone from your team) be willing to write something like a specification document for what is needed?

This would help get a conversation about RBAC in pulp_deb started. The best place to start that conversation is probably an RFC in the community forum: https://discourse.pulpproject.org/c/development/8

[cleonn]

@cleonn We currently have no plans/capacity to work on RBAC. I also don't have a clear conception what this entails. Given you seem to have some conception of "RBAC feature parity with pulp_rpm", would you (or anyone from your team) be willing to write something like a specification document for what is needed?

This would help get a conversation about RBAC in pulp_deb started. The best place to start that conversation is probably an RFC in the community forum: https://discourse.pulpproject.org/c/development/8

Thanks! We will finnish configuring and running pulp_rpm first and see exactly what we are missing and get back to this issue in a while!

[mdellweg]

I also don't have a clear conception what this entails.

It is all about writing meaningful (default) access policies on all the viewsets.

The hard part is usually discussing how much lockdown is needed/useful/not-too-inconvenient.

[quba42]

I only want to have one open issue for Domains/RBAC/multi tenancy support right now, so I am closing this in favor of #860