CODEWITHSUNDEEP
gerritaccess-rights
kresho
kresho

Reputation: 136

How to setup access rights inheritance in gerrit

We're have many projects (many repositories) and we're using gerrit for code reviews. Not all developers have access to all projects, and they may have different roles on different projects (developer, approver etc). Right now, every project has a set of groups and its own access policy which is structurally identical to all other projects and its becoming difficult to manage.

An example:

Projects: Project_A, Project_B

Groups: Project_A_Developer, Project_A_Approver, Project_B_Developer, Project_B_Approver

In Project_A's access page I set up that Project_A_Developer can push to /refs/for/refs/* and that Project_A_Approver can Code review.

In Project_B's access page I set up that Project_B_Developer can push to /refs/for/refs/* and that Project_B_Approver can Code review.

Now whenever we tune the process, we have to go through all projects' access pages and do the same change which is tedious and error prone.

We could have all project inherit access rights from All-projects, but then we would have to make a person a a member of the Developer group and he would be a developer on all projects, which we don't want.

I also tried playing with groups including one another, but couldn't achieve the desired result.

The question: how do we set up projects and groups so that the general access policy is inherited from a single project, yet a person can have different (or none) access rights on different projects?

Upvotes: 4

Views: 2742

Answers (1)

Frederik Gladhorn
Frederik Gladhorn

Reputation: 11

Create a hierarchy of projects.

All-Projects
   All-Group-1-Projects
       Project-A
   All-Group-2-Projects
       Project-B
       Project-C

When you now change the rights of All-Group-2-Projects, Project-B and C will be changed. All you have to do is create new projects with the right parent projects. Then you should do all permission changes in the parent projects and have basically no changes in the projects themselves.

Upvotes: 1

Related Questions