Event ACLs #1046
Event ACLs #1046
Conversation
| } | ||
| if none.EventWrite("") { | ||
| t.Fatalf("should not allow") | ||
| } | ||
| if none.ACLList() { | ||
| t.Fatalf("should not noneow") |
There was a problem hiding this comment.
It's a word, trust me :)
| case EventPolicyWrite: | ||
| return true | ||
| default: | ||
| return false |
There was a problem hiding this comment.
Is this a normal case we can hit or a programming error if we get here? Oh nm - this is where "deny" falls through to.
There was a problem hiding this comment.
Hitting this "default" covers the deny policy case for explicit denial. The policy is checked during compilation to ensure that one of read, write, or deny is specified, so technically it could be case EventPolicyDeny, but it shouldn't be any different and I just followed the convention from the rest of the file.
There was a problem hiding this comment.
Yeah sorry I realized that right after I made the comment :-)
|
LGTM |
| @@ -201,11 +201,6 @@ func (c *Client) RemoveFailedNode(node string) error { | |||
| return c.serf.RemoveFailedNode(node) | |||
| } | |||
|
|
|||
| // UserEvent is used to fire an event via the Serf layer | |||
| func (c *Client) UserEvent(name string, payload []byte) error { | |||
There was a problem hiding this comment.
We should remove UserEvent from the Server as well to be symmetric
|
@ryanuber Left some comments, but LGTM! |
Add server.serverCert.secretName to value to enable specifying a k8s secret containing server-cert If server.serverCert.secretName is specified, then the template should error if global.tls.caCert has not been set. Also, if server.serverCert.secretName is specified, the tls-init and tls-init-cleanup templates should not be rendered. Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>
This is the first part of adding ACL guards around firing user events. This can be extended to guard reading back event data later on, and adds the framework to allow that to happen.
I tried things a few different ways, so let me explain a couple of the things in here: