add system:image-auditor

[deads2k]

Adds a system:image-auditor role for components that want to monitor new images in the docker registry and annotate the image as "good" or "bad" based on scan results.

@smarterclayton Approval? I think this is low risk and helps teams trying to integrate with us.

@simon3z @moolitayer Comments on whether this satisfies your use-case?

[deads2k]

[test]

[openshift-bot]

Evaluated for origin test up to 7f6db1f

[smarterclayton]

@pweil- concerns for 1.2?

[simon3z]

@pweil- concerns for 1.2?

@pweil- @smarterclayton as you're mentioning, +1 for having this in 1.2 or something equivalent in openshift-ansible for management-admin.

[pweil-]

No concerns on a new role, low risk.

[liggitt]

I would not expect an auditor role to have any write permissions. Is there a different name we could use?

[deads2k]

I would not expect an auditor role to have any write permissions. Is there a different name we could use?

This is a thing that vets images to indicate whether they're good or bad. Alternate name suggestions welcome. I thought of this one and image-inspector, but thought that auditor was seemed like a better fit.

[openshift-bot]

continuous-integration/openshift-jenkins/test FAILURE (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/2880/)

[moolitayer]

Relates to ManageIQ/manageiq#7536

@deads2k Thanks!
Note we don't need read permissions on images - we don't currently read images. Having said that giving all those together might make sense for other/future auditors so it's up to you.

[smarterclayton]

Approved per pweil's assessment

On Mon, Apr 11, 2016 at 10:27 AM, Mooli Tayer [email protected]
wrote:

Relates to ManageIQ/manageiq#7536
ManageIQ/manageiq#7536

@deads2k https://github.com/deads2k Thanks!
Note we don't need read permissions on images - we don't currently read
images
https://github.com/ManageIQ/manageiq/blob/master/app/models/manageiq/providers/openshift/container_manager/refresher.rb#L9.
Having said that giving all those together might make sense for
other/future auditors so it's up to you.

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8455 (comment)

[deads2k]

@liggitt barring any better names, the rest looks clean?

[deads2k]

[merge]

[openshift-bot]

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_origin/5571/) (Image: devenv-rhel7_3956)

[openshift-bot]

Evaluated for origin merge up to 7f6db1f

[liggitt]

Would "approver" be more indicative of giving write access?

[smarterclayton]

The role definitely is intended to be vague - to cover viewing AND
modifying if necessary. Pruner might technically have this role.

On Tue, Apr 12, 2016 at 9:46 AM, Jordan Liggitt [email protected]
wrote:

Would "approver" be more indicative of giving write access?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8455 (comment)