Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reactivate code for permission_target resource to support non platform admins #1174

Open
Sam13 opened this issue Jan 17, 2025 · 4 comments
Open
Assignees
Labels
enhancement New feature or request wontfix This will not be worked on

Comments

@Sam13
Copy link

Sam13 commented Jan 17, 2025

Is your feature request related to a problem? Please describe.

With v12 the usage permission_target resource fails with error because it's code was removed.
The recommended usage of platform_permission (https://registry.terraform.io/providers/jfrog/platform/latest/docs/resources/permission) requires a platform admin token where as the permission_target can be partially managed with project admin access (Manually create, provide project admins group manage permissions and import into TF state).
For larger organizations where not all project administrators have platform admin permissions it's at least possible to manage the project specific permission targets via Terraform.

Describe the solution you'd like
Reactivate code for permission_target resource (https://registry.terraform.io/providers/jfrog/artifactory/12.8.1/docs/resources/permission_target) which was removed in cc89d20

Describe alternatives you've considered
Manage permission targets manually or stay at provider version 11

Additional context
Situation was already reported to JFrog but new permission APIs still require platform admin access rights (https://jfrog.com/help/r/jfrog-rest-apis/permissions) where as the previous APIs (https://jfrog.com/help/r/jfrog-rest-apis/permission-targets) allow non admins with Manage permissions on specific permission targets to change it (e.g. https://jfrog.com/help/r/jfrog-rest-apis/update-permission-target)

@Sam13 Sam13 added the enhancement New feature or request label Jan 17, 2025
@alexhung
Copy link
Member

@Sam13 I understand your request. The platform_permission uses the Platform Permission API that contains support for distributions (and other features), which are will not be retrofitted to Artifactory Permission Target API.

As the API token permission issue has already been reported, the preferred action here is to wait for the fix in the API level, instead of re-introduce the old Artifactory Permission Target resource.

If you need to use the old artifactory_permission_target resource in v11, perhaps you can configure a separate provider and use that for the permission target resources:

terraform {
  required_providers {
    artifactory = {
      source  = "jfrog/artifactory"
      version = "~> 12.0"
    }
    artifactory_v11 = {
      source  = "jfrog/artifactory"
      version = "~> 11.0"
    }
  }
}

resource "artifactory_permission_target" "my-permission-target" {
  provider = artifactory_v11
  ...
}

(I haven't tested this myself. This is just showing the idea.)

@alexhung alexhung added the wontfix This will not be worked on label Jan 17, 2025
@Sam13
Copy link
Author

Sam13 commented Jan 17, 2025

As the API token permission issue has already been reported, the preferred action here is to wait for the fix in the API level, instead of re-introduce the old Artifactory Permission Target resource.

The issue was reported more than half a year ago and nothing happened so far.
I don't know the internal state of that but in the end customer should be able to manage permission targets without need for platform administration rights.
Maybe you can try to push that internally?

If you need to use the old artifactory_permission_target resource in v11, perhaps you can configure a separate provider and use that for the permission target resources:

(I haven't tested this myself. This is just showing the idea.)

Good idea, will try that. Hope it's also supported with CDKTF...

@alexhung
Copy link
Member

alexhung commented Jan 17, 2025

The issue was reported more than half a year ago and nothing happened so far.
I don't know the internal state of that but in the end customer should be able to manage permission targets without need for platform administration rights.
Maybe you can try to push that internally?

I see! Can you share the JFrog contact with me so I can find out the internal bug report ticket? You can email me at alexh at jfrog.com

@Sam13
Copy link
Author

Sam13 commented Jan 20, 2025

@alexhung Check your inbox

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request wontfix This will not be worked on
Projects
None yet
Development

No branches or pull requests

2 participants