feat: limit project group creation to admins by olevski · Pull Request #1331 · SwissDataScienceCenter/renku-data-services

olevski · 2026-05-27T14:39:38Z

/deploy

This gives the ability for admins to make it so that only themselves or other admins are the only ones who can create projects or groups. This is a requested feature from enterprise users who want strict control of who can control projects and resources. To avoid proliferation and ensure existing resources are properly managed.

By default this option is turned off and the behaviour as the same as what we have before this feature - i.e. anyone can make a project or a group.

RenkuBot · 2026-05-27T14:40:41Z

You can access the deployment of this PR at https://renku-ci-ds-1331.dev.renku.ch

olevski · 2026-05-28T12:40:22Z

I tested in the CI deployment but if you switch off project and group creation and leave it like that, then the acceptance tests cannot pass because they need to create groups and/or projects in all cases.

olevski · 2026-05-29T09:45:19Z

A bunch of stuff here is just reformatted and it shows up as a large diff. I added coments to indicate what is new.

olevski · 2026-05-29T09:45:39Z

+  /platform/config/authorization:
+    get:
+      summary: Get the current authorization configuration for Renku
+      responses:
+        "200":
+          description: The authorization configuration
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthzConfig"
+        default:
+          $ref: "#/components/responses/Error"
+      tags:
+        - platform
+    patch:
+      summary: Update the authorization configuration
+      description: |
+        Requires admin permissions.
+      parameters:
+        - $ref: "#/components/parameters/If-Match"
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/AuthzConfigPatch"
+      responses:
+        "200":
+          description: The updated platform configuration
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/AuthzConfig"
+        default:
+          $ref: "#/components/responses/Error"
+      tags:
+        - platform


This is new.

olevski · 2026-05-29T09:46:04Z

+    AuthzFlag:
+      type: boolean
+      description: |
+        Controlls whether only admins or every user can perform a specific action.
+      default: false
+    AuthzConfig:
+      description: The authorization configuration for the whole platform.
+      type: object
+      properties:
+        etag:
+          $ref: "#/components/schemas/ETag"
+        only_admins_can_create_projects:
+          $ref: "#/components/schemas/AuthzFlag"
+        only_admins_can_create_groups:
+          $ref: "#/components/schemas/AuthzFlag"
+      required:
+        - etag
+        - only_admins_can_create_projects
+        - only_admins_can_create_groups
+      additionalProperties: false
+    AuthzConfigPatch:
+      description: Patch of the configuration of RenkuLab
+      type: object
+      properties:
+        only_admins_can_create_projects:
+          $ref: "#/components/schemas/AuthzFlag"
+        only_admins_can_create_groups:
+          $ref: "#/components/schemas/AuthzFlag"
+      additionalProperties: false


This is new

coveralls · 2026-05-29T09:46:40Z

Coverage Report for CI Build 26645617463

Coverage increased (+0.05%) to 86.362%

Details

Coverage increased (+0.05%) from the base build.
Patch coverage: 3 uncovered changes across 2 files (132 of 135 lines covered, 97.78%).
13 coverage regressions across 8 files.

Uncovered Changes

File	Changed	Covered	%
components/renku_data_services/platform/core.py	20	18	90.0%
components/renku_data_services/platform/blueprints.py	22	21	95.45%
Total (10 files)	135	132	97.78%

Coverage Regressions

13 previously-covered lines in 8 files lost coverage.

File	Lines Losing Coverage	Coverage
components/renku_data_services/crc/core.py	3	78.93%
components/renku_data_services/k8s/watcher/core.py	2	78.75%
components/renku_data_services/capacity_reservation/core.py	2	28.21%
components/renku_data_services/storage/blueprints.py	2	92.91%
components/renku_data_services/connected_services/core.py	1	50.62%
components/renku_data_services/users/db.py	1	90.36%
components/renku_data_services/base_api/pagination.py	1	88.16%
components/renku_data_services/project/core.py	1	89.47%

Coverage Stats


Relevant Lines:	31193
Covered Lines:	26939
Line Coverage:	86.36%
Coverage Strength:	1.5 hits per line

💛 - Coveralls

SalimKayal · 2026-05-29T09:45:42Z

+    assert res.status_code == 200, (res.status_code, res.text)
+    assert not res.json["only_admins_can_create_groups"], res.text
+    assert not res.json["only_admins_can_create_groups"], res.text
+    await asyncio.sleep(5)


why asyncio.sleep(5) could this be a source of tests flakiness ?

Oh my bad. I meant to remove that. It was from troubleshooting the tests. We dont need it anymore.

SalimKayal · 2026-05-29T09:49:10Z

            resource_type=platform.object_type,
            optional_resource_id=platform.object_id,
            optional_subject_filter=sub_filter,
+            optional_relation="admin",


Suggested change

optional_relation="admin",

optional_relation=_Relation.admin.value,

eikek · 2026-05-29T10:08:26Z

 )
+
+_v10 = """\
+definition user {}


I think, this is the only change here:

definition platform { relation admin: user + relation project_creator: user:* + relation group_creator: user:* permission is_admin = admin + permission create_projects = is_admin + project_creator + permission create_groups = is_admin + group_creator }

Yes I meant to post the diff but I forgot. But I double checked just now to make sure. And yes that is the change from v9 to v10.

SalimKayal

looks good on my side.

Make it so that (if configured) admins are the only one allowed to create projects and groups. By default we have the old behavior so that everyone who is logged in can create a group or project. The limits are applied in addition to all other authroization schemes and regardless of where the project will be created (username or group).

olevski · 2026-05-29T15:18:37Z

I rebased and can confirm that the diff stays the same:

olevski requested review from a team, SalimKayal and sgaist as code owners May 27, 2026 14:39

olevski marked this pull request as draft May 27, 2026 14:39

olevski force-pushed the feat-limit-project-group-creation-to-admins branch from de41b99 to 0b80403 Compare May 28, 2026 12:09

olevski marked this pull request as ready for review May 28, 2026 12:40

olevski commented May 29, 2026

View reviewed changes

SalimKayal requested changes May 29, 2026

View reviewed changes

eikek previously approved these changes May 29, 2026

View reviewed changes

olevski dismissed eikek’s stale review via b598c28 May 29, 2026 12:17

SalimKayal previously approved these changes May 29, 2026

View reviewed changes

olevski dismissed SalimKayal’s stale review via 8da33be May 29, 2026 13:26

olevski added 13 commits May 29, 2026 16:28

chore: add authzed db migration

4bf2395

squashme: minor fix

1019da2

chore: minor fix

f31ca04

chore: add tests

33c98d0

squashme: minor fix

0195e4b

squashme: remove old migration test

d593c81

chore: fix asserts in tests

5869c36

chore: remove default value for flag

5ea3250

chore: check etag

d6ad2bb

chore: fix spelling

3ae8088

chore: remove unused sleep

ba345e9

chore: use relation enum

93147d9

olevski added 2 commits May 29, 2026 16:29

chore: make authzed flags enums

e693860

chore: rebase the migrations

9f8bc4e

olevski force-pushed the feat-limit-project-group-creation-to-admins branch from 8da33be to 9f8bc4e Compare May 29, 2026 15:17

olevski requested review from SalimKayal and eikek May 29, 2026 16:58

olevski enabled auto-merge (squash) May 29, 2026 16:59

	optional_relation="admin",
	optional_relation=_Relation.admin.value,

Conversation

olevski commented May 27, 2026

Uh oh!

RenkuBot commented May 27, 2026

Uh oh!

olevski commented May 28, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

coveralls commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 26645617463

Coverage increased (+0.05%) to 86.362%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SalimKayal left a comment

Choose a reason for hiding this comment

Uh oh!

olevski commented May 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coveralls commented May 29, 2026 •

edited

Loading