Add an in-memory superusermanager, which stores the current list of superusers in a process-shared Value. We do this because in the ER, when we add a new superuser, we need to ensure that ALL workers have their lists updated (otherwise we get the behavior that some workers validate the new permission and others do not).

auth/permissions.py

@@ -7,7 +7,7 @@ from functools import partial
 import scopes
 
 from data import model
-from app import app
+from app import app, superusers
 
 
 logger = logging.getLogger(__name__)
@@ -94,8 +94,7 @@ class QuayDeferredPermissionUser(Identity):
         return super(QuayDeferredPermissionUser, self).can(permission)
 
       # Add the superuser need, if applicable.
-      if (user_object.username is not None and
-          user_object.username in app.config.get('SUPER_USERS', [])):
+      if superusers.is_superuser(user_object.username):
         self.provides.add(_SuperUserNeed())
 
       # Add the user specific permissions, only for non-oauth permission