doc: Design admin control over non admin specs #45
Conversation
Signed-off-by: Mateus Oliveira <msouzaol@redhat.com>
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mateusoliveira43 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| ## Non-Goals | ||
|
|
||
| - Remove restricted specs or show their custom default values in NonAdminBackup/NonAdminRestore (non admin users can still create NonAdminBackup/NonAdminRestore with restricted specs, but they will be simply not reconciled by NAC, with an error explaining why) | ||
| - Allow admin users to restrict second level specs (for example, `labelSelector` can be restricted, but not `labelSelector.matchLabels`) |
There was a problem hiding this comment.
is this ok?
|
|
||
| ## Goals | ||
|
|
||
| - Enable admin users to restrict which NonAdminBackup/NonAdminRestore specs non admin users can use, and set custom default values to these specs |
There was a problem hiding this comment.
I was thinking about having 2 options:
- just restrict
- restrict and have custom default value
Thinking about implementation, having just estrict and have custom default value seems easier to implement. Is this ok?
|
|
||
| ## Background | ||
|
|
||
| Non Admin Controller (NAC) adds the ability to admin users restrict the use of OADP operator for non admin users, by only allowing them to create backup/restores from their namespaces with NonAdminBackup/NonAdminRestore. Admin users may want to further restrict non admin users operations, like forcing a specific NonAdminBackup type. This design enables admin users to restrict which NonAdminBackup/NonAdminRestore specs will be open for non admin users and set custom default values for these specs. |
There was a problem hiding this comment.
do we need control over restores or just backups is enough?
Why the changes were made
Create design for adding new feature that was request by users.
Related to #33
Related to #37
Blocked by #44
How the changes were made
Studied possibilities of how to add new feature into NAC.
How to test the changes made
Read design and see if it is clear.