Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[IA-5060] Inherit manager roles to notebook-cluster and persistent-disk #1535

Merged
merged 7 commits into from
Sep 10, 2024
Merged

[IA-5060] Inherit manager roles to notebook-cluster and persistent-disk #1535

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b24e5fd
Fix Leo access control
rtitle Sep 6, 2024
6b0a73d
Remove list_persistent_disk
rtitle Sep 6, 2024
010002f
Don't remove google-project actions just yet
rtitle Sep 6, 2024
8af11cb
Make sure to add set_parent
rtitle Sep 6, 2024
a6f126d
Remove authDomainConstrainable from the top level
rtitle Sep 9, 2024
51acf0d
Shared apps should be auth domain constrainable too
rtitle Sep 9, 2024
f73189f
empty
rtitle Sep 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 29 additions & 3 deletions src/main/resources/reference.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,8 @@ resourceTypes = {
wds-instance = ["owner"]
kubernetes-app = ["manager"]
kubernetes-app-shared = ["owner", "user"]
notebook-cluster = ["manager"]
persistent-disk = ["manager"]
}
}
application = {
Expand Down Expand Up @@ -606,6 +608,12 @@ resourceTypes = {
reuseIds = false
}
google-project = {
# TODO: remove the following actions when notebook-cluster and persistent-disk have migrated to have parent resources.
# - list_notebook_cluster
# - delete_notebook_cluster
# - stop_start_notebook_cluster
# - list_persistent_disk
# - delete_persistent_disk
actionPatterns = {
read_policies = {
description = "list all policies and policy details for this google-project"
Expand Down Expand Up @@ -660,6 +668,8 @@ resourceTypes = {
includedRoles = ["notebook-user", "pet-creator"]
descendantRoles = {
kubernetes-app = ["manager"]
notebook-cluster = ["manager"]
persistent-disk = ["manager"]
}
}
notebook-user = {
Expand Down Expand Up @@ -790,6 +800,7 @@ resourceTypes = {
}
connect = {
description = "connect to the Jupyter notebook running on the notebook cluster"
authDomainConstrainable = true
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am a bit confused about how granular the authDomainConstrainable is here. I thought that every resources / actions would inherit that configuration from the workspace after Doug's PR

Copy link
Contributor Author

@rtitle rtitle Sep 6, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My understanding was you still have to annotate which actions on the child are authDomainConstrainable (like connect). @dvoet can you confirm?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rtitle is correct. The auth domain is inherited but which actions have the auth domain applied is controlled by the authDomainConstrainable setting.

}
delete = {
description = "delete the notebook cluster"
Expand All @@ -803,22 +814,29 @@ resourceTypes = {
modify = {
description = "modify attributes of the cluster"
}
set_parent = {
description = "set parent of notebook cluster"
}
}
ownerRoleName = "creator"
roles = {
creator = {
roleActions = ["status", "connect", "delete", "read_policies", "stop_start", "modify"]
roleActions = ["status", "connect", "delete", "read_policies", "stop_start", "modify", "set_parent"]
}
manager = {
roleActions = ["status", "delete", "read_policies"]
}
}
reuseIds = false
}
persistent-disk = {
actionPatterns = {
read = {
description = "read metadata and contents of persistent disk"
description = "read metadata of persistent disk"
Copy link
Contributor Author

@rtitle rtitle Sep 6, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

read is just used for listing disks; attach is needed to actually view the contents of a disk

}
attach = {
description = "attach persistent disk to a VM"
authDomainConstrainable = true
}
modify = {
description = "modify persistent disk"
Expand All @@ -829,11 +847,17 @@ resourceTypes = {
read_policies = {
description = "view all policies and policy details for the persistent disk"
}
set_parent = {
description = "set parent of persistent disk"
}
}
ownerRoleName = "creator"
roles = {
creator = {
roleActions = ["read", "attach", "modify", "delete", "read_policies"]
roleActions = ["read", "attach", "modify", "delete", "read_policies", "set_parent"]
}
manager = {
roleActions = ["delete", "read", "read_policies"]
}
}
reuseIds = false
Expand All @@ -845,6 +869,7 @@ resourceTypes = {
}
connect = {
description = "connect to kubernetes application"
authDomainConstrainable = true
}
update = {
description = "update kubernetes application"
Expand Down Expand Up @@ -883,6 +908,7 @@ resourceTypes = {
}
connect = {
description = "connect to kubernetes application"
authDomainConstrainable = true
}
update = {
description = "update kubernetes application"
Expand Down
Loading