add proposal for robot permission expansion #249
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: wang yan <wangyan@vmware.com>
wy65701436
force-pushed
the
robot-extend
branch
from
5ee1671
to
3e07e2d
Compare
reasonerjt
reviewed
Aug 22, 2024
reasonerjt
reviewed
Aug 22, 2024
reasonerjt
reviewed
Aug 22, 2024
reasonerjt
reviewed
Aug 22, 2024
reasonerjt
reviewed
Aug 22, 2024
reasonerjt
reviewed
Aug 22, 2024
reasonerjt
reviewed
Aug 22, 2024
Signed-off-by: wang yan <wangyan@vmware.com>
reasonerjt
reviewed
Sep 4, 2024
reasonerjt
reviewed
Sep 4, 2024
reasonerjt
reviewed
Sep 4, 2024
reasonerjt
reviewed
Sep 4, 2024
Signed-off-by: wang yan <wangyan@vmware.com>
Signed-off-by: wang yan <wangyan@vmware.com>
stonezdj
reviewed
Sep 11, 2024
| 2. any system level robot account can be created by a system level robot account who with the robot creation permission. | ||
|
|
||
| Deletion/Update: A robot account cannot assign permissions to another robot account that exceed its own permissions. | ||
| 1. any robot account that created by another robot can be updated by the creator robot or the itself, provided that the update permission has been granted to the creator or the robot itself. |
There was a problem hiding this comment.
the itself should be itself
stonezdj
reviewed
Sep 11, 2024
| ## Robot accounts that are created and managed by another robot accounts | ||
|
|
||
| Robot accounts are principals, it means that you can grant robot account to Harbor resources. However, from the perspective of preventing privilege escalation, generally, a robot account | ||
| cannot grant roles that are higher or more powerful than the roles it possesses. When a robot account creates a new robot account, the new robot account doesn't automatically inherit any roles |
There was a problem hiding this comment.
replace role with permission, avoid using role because the role is only used in project member,
stonezdj
approved these changes
Sep 18, 2024
Signed-off-by: wang yan <wangyan@vmware.com>
reasonerjt
approved these changes
Sep 25, 2024
Vad1mo
reviewed
Sep 25, 2024
wy65701436
added a commit
to wy65701436/harbor
that referenced
this pull request
Sep 26, 2024
Update codes according to the proposal of goharbor/community#249 Signed-off-by: wang yan <wangyan@vmware.com>
wy65701436
added a commit
to wy65701436/harbor
that referenced
this pull request
Sep 26, 2024
Update codes according to the proposal of goharbor/community#249 Signed-off-by: wang yan <wangyan@vmware.com>
wy65701436
added a commit
to wy65701436/harbor
that referenced
this pull request
Sep 26, 2024
Update codes according to the proposal of goharbor/community#249 Signed-off-by: wang yan <wangyan@vmware.com>
wy65701436
added a commit
to goharbor/harbor
that referenced
this pull request
Sep 26, 2024
* have option to enable robot full access When the system admin enable this option, the robot can be assigned with robot/user/group/quota permissions. Signed-off-by: wang yan <wangyan@vmware.com> * robot account permission enhancement Update codes according to the proposal of goharbor/community#249 Signed-off-by: wang yan <wangyan@vmware.com> --------- Signed-off-by: wang yan <wangyan@vmware.com>
Signed-off-by: wang yan <wangyan@vmware.com>
Signed-off-by: wang yan <wangyan@vmware.com>
wy65701436
force-pushed
the
robot-extend
branch
from
8cf6aef
to
8a9319a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.