luxolus
/
open-nomad
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

acl: Add alloc-lifecycle namespace capability 

This capability will gate access to features that allow interacting with
a running allocation, for example, signalling, stopping, and rescheduling
specific allocations.
This commit is contained in:
Danielle Tomlinson 2019-03-05 10:39:06 +01:00 committed by Danielle Lancashire
parent 24d3d723a8
commit 803e1a8b86
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
acl/policy.go
View File

@ -28,6 +28,7 @@ const (
NamespaceCapabilityDispatchJob = "dispatch-job"
NamespaceCapabilityReadLogs = "read-logs"
NamespaceCapabilityReadFS = "read-fs"
NamespaceCapabilityAllocLifecycle = "alloc-lifecycle"
NamespaceCapabilitySentinelOverride = "sentinel-override"
)
@ -93,7 +94,7 @@ func isNamespaceCapabilityValid(cap string) bool {
switch cap {
case NamespaceCapabilityDeny, NamespaceCapabilityListJobs, NamespaceCapabilityReadJob,
NamespaceCapabilitySubmitJob, NamespaceCapabilityDispatchJob, NamespaceCapabilityReadLogs,
NamespaceCapabilityReadFS:
NamespaceCapabilityReadFS, NamespaceCapabilityAllocLifecycle:
return true
// Separate the enterprise-only capabilities
case NamespaceCapabilitySentinelOverride:
@ -122,6 +123,7 @@ func expandNamespacePolicy(policy string) []string {
NamespaceCapabilityDispatchJob,
NamespaceCapabilityReadLogs,
NamespaceCapabilityReadFS,
NamespaceCapabilityAllocLifecycle,
}
default:
return nil

1
acl/policy_test.go
View File

@ -80,6 +80,7 @@ func TestParse(t *testing.T) {
NamespaceCapabilityDispatchJob,
NamespaceCapabilityReadLogs,
NamespaceCapabilityReadFS,
NamespaceCapabilityAllocLifecycle,
},
},
{