{"action":"closed","issue":{"url":"https://api.github.com/repos/cockpit-project/cockpit/issues/4218","repository_url":"https://api.github.com/repos/cockpit-project/cockpit","labels_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/4218/labels{/name}","comments_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/4218/comments","events_url":"https://api.github.com/repos/cockpit-project/cockpit/issues/4218/events","html_url":"https://github.com/cockpit-project/cockpit/issues/4218","id":148474148,"number":4218,"title":"Registry: \"New project\" policy fixes","user":{"login":"aweiteka","id":1764461,"avatar_url":"https://avatars.githubusercontent.com/u/1764461?v=3","gravatar_id":"","url":"https://api.github.com/users/aweiteka","html_url":"https://github.com/aweiteka","followers_url":"https://api.github.com/users/aweiteka/followers","following_url":"https://api.github.com/users/aweiteka/following{/other_user}","gists_url":"https://api.github.com/users/aweiteka/gists{/gist_id}","starred_url":"https://api.github.com/users/aweiteka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aweiteka/subscriptions","organizations_url":"https://api.github.com/users/aweiteka/orgs","repos_url":"https://api.github.com/users/aweiteka/repos","events_url":"https://api.github.com/users/aweiteka/events{/privacy}","received_events_url":"https://api.github.com/users/aweiteka/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"aweiteka","id":1764461,"avatar_url":"https://avatars.githubusercontent.com/u/1764461?v=3","gravatar_id":"","url":"https://api.github.com/users/aweiteka","html_url":"https://github.com/aweiteka","followers_url":"https://api.github.com/users/aweiteka/followers","following_url":"https://api.github.com/users/aweiteka/following{/other_user}","gists_url":"https://api.github.com/users/aweiteka/gists{/gist_id}","starred_url":"https://api.github.com/users/aweiteka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aweiteka/subscriptions","organizations_url":"https://api.github.com/users/aweiteka/orgs","repos_url":"https://api.github.com/users/aweiteka/repos","events_url":"https://api.github.com/users/aweiteka/events{/privacy}","received_events_url":"https://api.github.com/users/aweiteka/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2016-04-14T20:32:06Z","updated_at":"2016-05-02T07:34:40Z","closed_at":"2016-05-02T07:34:40Z","body":"Version 0.102\r\n\r\nNew project policy selection isn't providing the correct permissions. Below is the tested behavior we want. Note, I added \"project\" to the pull-down menu text to make it clearer.\r\n\r\n*Allow only project members to pull images* should remove registry-viewer permission (this is necessary since the default project template may add this by default).\r\n\r\n```\r\noc policy remove-role-from-group registry-viewer system:authenticated -n <project>\r\n```\r\n\r\n*Allow project non-members to pull images* should add registry-viewer permission\r\n```\r\noc policy add-role-to-group registry-viewer system:authenticated -n <project>\r\n```\r\n\r\n**Future**\r\nWe want to support unauthenticated docker pull. See backlog item https://trello.com/c/Ev8y3pC4\r\nIn this case we would want to add an \"unauthenticated users\" drop-down\r\n\r\n*Allow anyone to pull images* should add registry-viewer permission to unauth'd\r\n```\r\noc policy add-role-to-group registry-viewer system:unauthenticated -n <project>\r\n```\r\n"}}