jenkinsci / jenkinsci/lockable-resources-plugin
Feature idea: group resources (maybe new field like label?) to fine-grain management permissions
- Dominant language
- Java
- Stars
- 99
- Forks
- 205
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 8
Description
### Feature Request
Currently the permissions system for lockable resources is a relatively large sledgehammer: either a user has no access to see/manage/... the resources, or can access all of them.
For larger developer teams managing different resources, as well as for "infra tokens" vs. resources that represent physical resources, or whatever other reason we can think of, it may be useful to offer a way to group resources and dynamically define permissions for such resource-groups that can be assigned to Jenkins user accounts same way as current 3-4 permissions are given.
Technically it might be some other way around, e.g.:
* Define a Lockable resource group (in Global config?)
* Permissions other than defaults in https://github.com/jenkinsci/lockable-resources-plugin/blob/master/src/main/java/org/jenkins/plugins/lockableresources/actions/LockableResourcesRootAction.java#L36 appear, like "Reserve LR Group X", based on currently defined LR groups in the Jenkins config... can this be read during startup initialization and during config saving?
* Permissions can then be assigned to users with whatever strategy supports them
* Lockable resources would have a field (drop-down choice?) to place them into a group, or to leave effectively in the default nameless group.
TBD: are un-grouped resources accessible to everyone (with generic permission like "Reserve" vs. "Reserve LR Group X") like they are now, for least-surprise during upgrades? Or something would be more reasonable?
Are "un-grouped rights" (hardcoded ones) to be applied for access to all resources as now (least surprise + easiest path), or only to un-grouped ones?..
Contributor guide
Assessment
This issue has not been assessed yet.