search

TritonDataCenter / terraform-provider-triton

Terraform Joyent Triton provider
https://www.terraform.io/docs/providers/triton/
Mozilla Public License 2.0
15 stars 24 forks source link

Feature: support for interacting with Triton as a sub-user #55

Closed misterbisson closed 6 years ago

misterbisson commented 7 years ago

Triton supports sub-users within an account. The details of that are better explained in the docs on role based access control.

When using node-triton and node-smartdc, you can interact with Triton as a sub-user by specifying a TRITON_USER or SDC_USER env var along with the TRITON_ACCOUNT and a valid SSH key for the given user. The Triton provider, however, does not support that. This was an intentional omission previously, but it's a feature we should consider.

misterbisson commented 7 years ago

It has been kindly pointed out that this might already work. The TRITON_ACCOUNT account is needed to construct some URLs, but the TRITON_USER may not be used at all. Instead, the critical part is the SSH key for that sub-user.

So, this might work as-is, but we'll need to add tests for it.

This has been confirmed working.

misterbisson commented 6 years ago

Update, there are some read-only cases this might work for, but we've encountered issues with interactions that are not strictly read-only that need further investigation.

The RBAC model in Triton is a target for significant revisions (see https://github.com/joyent/rfd/blob/master/rfd/0048/README.md, for example), and there are known bugs with the existing RBAC implementation that may prove intractable here.

There doesn't appear to be any solid foundation to build on here at this time, so I'm closing this ticket and will open a new one once we get better underlying API support to target.