Wildcards in repository names

[mkstephenson]

When defining the repositories in the scope-map, can you use wildcards? So if you have a convention that each repository is named <team_name>/<project_name>, you could use <team_name>/* to provide a team with access to all of their repositories without listing each one individually and also automatically provide access to any future repositories created by this team?

---

Dokumentdetails

⚠ Bearbeiten Sie diesen Abschnitt nicht. Er ist für die Verknüpfung von docs.microsoft.com zum GitHub-Artikel erforderlich.

• ID: ef39d073-f33a-44c5-9cd1-4f30ea881230
• Version Independent ID: a28f7fa6-d25a-c205-14e7-aa8d474a87c9
• Content: az acr scope-map
• Content Source: src/azure-cli/azure/cli/command_modules/acr/_help.py
• Service: container-registry
• GitHub Login: @rloutlaw
• Microsoft Alias: routlaw

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @SteveLasker, @sajayanthony

[yugangw-msft]

Thanks for the suggestions.
Repository based permission control is still under preview, and we will take this feedback into consideration and update here when we roll out any improvements.

[shwetazambre]

I am also looking for a help on "Wildcards in repository names ", any update on this?

[SteveLasker]

Hi folks. We’re looking into various options.
Can you provide more details on what the result is you’re looking to accomplish?

[shwetazambre]

I created a scope map with a wildcard so that many repositories can make use of it. And with this scope map generated a token and logged in to the registry. But I couldn't perform any operation like a pull or push.

e.g
repositories:

test/myrepo
test/myrepo1
test/myrepo2
test/myrepo3

Scope-map I have created:

az acr scope-map create --name MyScopeMap --registry MyRegistry --repository test/* content/read content/write --description "test scope map"

Result:
{
"actions": [
"repositories/test/*/content/read",
"repositories/test/*/content/write"
],
"creationDate": "2020-04-20T11:27:49.643716+00:00",
"description": "test scope map",
"id": "/subscriptions/----/resourceGroups/mytest-rg/providers/Microsoft.C
ontainerRegistry/registries/MyRegistry/scopeMaps/MyScopeMap",
"name": "MyScopeMap",
"provisioningState": "Succeeded",
"resourceGroup": "mytest-rg",
"scopeMapType": "UserDefined",
"type": "Microsoft.ContainerRegistry/registries/MyScopeMap"
}

Scope map has created successfully and even token too. But when I logged in with that token and try to pull/push I ended up with below message:

pull -
docker pull myregistry.azurecr.io/test/myrepo:v1

message:

"Error response from daemon: repository myregistry.azurecr.io/test/myrepo not found: does not exist or no pull access"

push -
docker push myregistry.azurecr.io/test/myrepo:v2

message:

The push refers to a repository [myregistry.azurecr.io/test/myrepo]
a65c16532822: Preparing
75b1b9938a41: Preparing
94a7e5001357: Preparing
fea4f503ccf8: Preparing
3172a1c8308a: Preparing
264a7fdea008: Waiting
3b10514a95be: Waiting
denied: requested access to the resource is denied

[SteveLasker]

@shwetazambre, thanks for the details. We don’t support wildcards like this. Based on feedback like this, we’re re-evaluating the approach and are seeking feedback.
Can you explain what you’re trying to accomplish? Are you looking to have management delegation to team leads for a set of repos? Or, can a single set of people manage permissions for all teams?
In other words, do you need permissions isolation between teams?
TeamA can manage their set of repos, while teamB manages their repositories? The owners of TeamA can’t manage TeamBs repos

[mkstephenson]

@shwetazambre, thanks for the details. We don’t support wildcards like this. Based on feedback like this, we’re re-evaluating the approach and are seeking feedback.
Can you explain what you’re trying to accomplish? Are you looking to have management delegation to team leads for a set of repos? Or, can a single set of people manage permissions for all teams?
In other words, do you need permissions isolation between teams?
TeamA can manage their set of repos, while teamB manages their repositories? The owners of TeamA can’t manage TeamBs repos

That is the approach we were looking for as well. We need to be able to assign repo based permissions and would prefer not to have to define it for every single repo since we work with prefixes for teams.

[SteveLasker]

We’re considering two approaches. The wildcard approach, which could give different groups different access.
The second approach is about delegating management to teams.
Imagine an Org like management approach similar to github or docker hub.
The later is a lot more complicated to split permissions and logs. But, we’d rather understand that now, before we implement wildcards that won’t scale.
Which approach do you need?

[shwetazambre]

As far as I know, we are looking for an approach similar to the first one. Here I consider the group as a project/team. If we assign read-only permission for project1/team1 then all repositories under that project/team will have the same permission. Different projects will have different permissions and all repositories, sub-repositories will work according to that permissions.

[BenjaminHerbert]

We like the concept of namespaces, as that is described in a section in the "best practices".
I'd like to enable teams full access to one or several "namespaces". I guess that could work with tokens & wildcard scope maps, but I can imagine this not scaling well.
So we'd prefer a "full fledged" solution to be able to control access to namespaces for groups - ideally without tokens - distributing these will definitely not scale.

[ajhall]

We're looking for this feature too and would upgrade to the Premium SKU if it was available. Our needs are fairly simple right now, so the first approach would be sufficient for us, but I could see some benefit to the second approach as well.