Bug 1159105

Summary: flesh out "queue_admin" feature: add docs, use a permission instead of a hard-coded group name
Product: [Retired] Beaker Reporter: Dan Callaghan <dcallagh>
Component: generalAssignee: Dan Callaghan <dcallagh>
Status: CLOSED CURRENTRELEASE QA Contact: Anwesha Chatterjee <achatter>
Severity: unspecified Docs Contact:
Priority: medium    
Version: 0.18CC: achatter, dcallagh, ebaak, rjoost
Target Milestone: 25.0Keywords: FutureFeature, Patch, Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-03-19 04:18:50 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Dan Callaghan 2014-10-31 01:34:18 UTC 
Currently Beaker has an undocumented feature where users in the special group 'queue_admin' are permitted to change the priority of any job. But:

* it should be documented
* it should be set up by default (currently beaker-init does not create the group)
* it should use a proper TG permission, in the same style as 'secret_visible', instead of hard-coding the group name

Converting it to a permission needs to be done in a backwards-compatible way. Namely an existing 'queue_admin' group should be granted the new permission.

Once it is using a permission, we can remove the special protections which prevent renaming the 'queue_admin' group.
Comment 1 Dan Callaghan 2018-01-08 02:41:13 UTC 
Found an old patch I wrote for this last year...
Comment 2 Dan Callaghan 2018-01-10 01:33:55 UTC 
https://gerrit.beaker-project.org/5968
Comment 3 Dan Callaghan 2018-02-06 00:25:09 UTC 
This can go to 26.0, no need to make the 25.0 release even bigger at this point.
Comment 4 Dan Callaghan 2018-02-22 02:35:46 UTC 
I accidentally just merged this for 25.0, forgetting that I was going to hold off until 26.0 to avoid making 25.0 even bigger.
Comment 5 Dan Callaghan 2018-02-22 04:36:41 UTC 
The new permission is called 'change_prio'.

Suggested steps to verify:
1. Check the docs for it make sense...
2. As a Beaker admin, create a new group, give the group 'change_prio' permission, add an otherwise unprivileged user to the group.
3. Submit a job to Beaker.
4. While the job is queued, as the unprivileged user go to the job page and adjust its priority up or down.
Comment 7 Anwesha Chatterjee 2018-03-07 00:53:25 UTC 
Verified that 

* the docs for it make sense
* the user "unprivileged" (part of group "queue_admin_test" with change_prio permission) could successfully bump priority of a job (not created by unprivileged) up or down
Comment 8 Roman Joost 2018-03-19 04:18:50 UTC 
Beaker 25.0 has been released.

Release notes are available upstream: https://beaker-project.org/docs/whats-new/release-25.html