RFE: Allow assigning an organization IG to a job template without requiring org admin

[Ompragash]

ISSUE TYPE

• Feature Idea

COMPONENT NAME

• API
• UI

SUMMARY

Currently in AWX only System Admin/Org Admin can assign Instance Group but needs new role i.e. "Instance Group Admin" role and this role will help a user to assign existing instance group in a Job Template.

[wenottingham]

This seems the wrong way to do this, since the roles would likely be on the IGs, and you're not administrating them.

[ulysses-31]

It would be great if users could select instance groups assigned to their organization to their job templates (without granting them Org Admin). Perhaps via a new Org/Role or enhancement of Org/Job Template Admins?

[wenottingham]

see also #2785

[wenottingham]

retitled to reflect the problem that needs solved

[mikeycmccarthy]

Also interested in this one! It seems a funny one in terms of what the permission is on. A job template admin can't assign the instance group, but is that because they can't 'use' the instance group effectively?

[schmandforke]

+1

[williamhanseneric]

+1

[AlanCoding]

The challenge I see here is that the InstanceGroup model is not directly scoped to a single organization. When a resource has admin_role, the standard pattern is that organization.admin_role becomes a parent role for it, assuming it has an organization ForeignKey. Instance groups do not.

Giving permissions via a many-to-many to organizations while also using that for fallback rules introduced some debt that we're going to have to resolve here. Depending on the big-picture direction from @ffirg and others, we may introduce a new ForeignKey organization field. I don't like that idea, because it's an addition to the data model which isn't 100% necessary. The alternative is that we have InstanceGroup.admin_role just have the system admin role as the parent role. This seems expedient to me.

In any case, we will require additional special data migration steps

1. Any organization admin who used to get permission to an instance group via the many-to-many relationship will probably need to be added to the instance group admin_role explicitly (then the hierarchy rebuilt, standard stuff)
2. We will need to create roles for the instance groups from before the migration. There are pretty standard patterns for this as well.