Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding CEL Validation for Permission Claim #1529

Merged
merged 2 commits into from
Jul 20, 2022
Merged

Adding CEL Validation for Permission Claim #1529

merged 2 commits into from
Jul 20, 2022

Conversation

shawn-hurley
Copy link

Summary

Adding CEL Validation as an option for the APIServer

For Permission Claims adding validations:

  1. When group is empty, then only allow resource in [configmaps,secrets,namespaces,serviceaccounts]
  2. If the group is not empty, then make sure we have a specific identity hash.

Related issue(s)

Fixes #1331

@openshift-ci openshift-ci bot requested review from davidfestal and sttts July 14, 2022 18:16
@shawn-hurley shawn-hurley force-pushed the issue-1331-openapi-permclaim-identiy-core-types branch from 4d12f5d to 1f61d58 Compare July 14, 2022 19:32
sttts
sttts reviewed Jul 15, 2022
View reviewed changes
config/crds/apis.kcp.dev_apibindings.yaml Outdated
@@ -69,6 +69,12 @@ spec:
required:
- resource
type: object
x-kubernetes-validations:
- message: if claim for core group must only be one of configmaps,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

core group does not really matter here. You can claim Services or Pods. I think the only restriction we can and should have is about the identity.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We don't have all of those types in internal api schemes yet so they would have no effect and we wouldn't be able to serve them.

Are we planning on adding all the internal types?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We may want to update this in the future. But if we are providing things like RBAC, that will not be the core group and will not have an identityHash. I believe that for now let's keep as is (most restrictive) and we can open it up as that path is usually more accessible. Thoughts?

@shawn-hurley shawn-hurley force-pushed the issue-1331-openapi-permclaim-identiy-core-types branch 2 times, most recently from aed23f7 to f014f44 Compare July 18, 2022 19:12
shawn-hurley
shawn-hurley commented Jul 18, 2022
View reviewed changes
pkg/apis/tenancy/initialization/utils_test.go
@@ -25,14 +25,6 @@ import (
tenancyv1alpha1 "github.com/kcp-dev/kcp/pkg/apis/tenancy/v1alpha1"
)

func TestClusterWorkspaceInitializerLabelPrefix(t *testing.T) {
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@stevekuznetsov Can you please verify that this ok?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ClusterWorkspaceInitializerLabelPrefix is ending a slash. So yes, this test is not valid anymore.

@shawn-hurley shawn-hurley force-pushed the issue-1331-openapi-permclaim-identiy-core-types branch 2 times, most recently from 50123c2 to 2d58978 Compare July 18, 2022 20:12
@shawn-hurley shawn-hurley mentioned this pull request Jul 19, 2022
Closed
sttts
sttts reviewed Jul 19, 2022
View reviewed changes
sttts
sttts reviewed Jul 19, 2022
View reviewed changes
@shawn-hurley shawn-hurley force-pushed the issue-1331-openapi-permclaim-identiy-core-types branch 2 times, most recently from e78569b to d910bf6 Compare July 19, 2022 15:52
shawn-hurley
shawn-hurley commented Jul 19, 2022
View reviewed changes
config/crds/apis.kcp.dev_apibindings.yaml-patch Outdated
path: /spec/versions/name=v1alpha1/schema/openAPIV3Schema/properties/spec/properties/acceptedPermissionClaims/items/x-kubernetes-validations
value:
- rule: |
(((has(self.group) && self.group == '') || !(has(self.group))) && self.resource in ['configmaps', 'namespaces', 'secrets', 'serviceaccounts']) || ((has(self.group) && self.group != '') && (has(self.identityHash) && self.identityHash != ''))
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not have a way to do it because the rules are ANDed together AFAICT

@kcp-dev kcp-dev deleted a comment from sttts Jul 20, 2022
Adding CEL validation for permission claims on bindings and exports
0fcf51f 
* Validate that empty group means only internal types that are valid
* Validate that if a group is set, that an identityHash must also be
  set.
@shawn-hurley shawn-hurley force-pushed the issue-1331-openapi-permclaim-identiy-core-types branch from fbbc381 to 0fcf51f Compare July 20, 2022 18:07
sttts
sttts reviewed Jul 20, 2022
View reviewed changes
config/crds/apis.kcp.dev_apibindings.yaml
['configmaps', 'namespaces', 'secrets', 'serviceaccounts']
- message: .identityHash must be set if .group is not empty.
rule: '!(has(self.group) && self.group != '''') || (has(self.identityHash)
&& self.identityHash != '''')'
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

much better

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I honestly have never done logic like this or at least forgot that it was possible. Thanks for teaching!

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://en.wikipedia.org/wiki/Conjunctive_normal_form

@sttts
Copy link
Member

sttts commented Jul 20, 2022

/lgtm
/approve

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jul 20, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jul 20, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sttts

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 20, 2022
@openshift-merge-robot openshift-merge-robot merged commit bc41c67 into kcp-dev:main Jul 20, 2022
stevekuznetsov
stevekuznetsov reviewed Jul 20, 2022
View reviewed changes
config/crds/apis.kcp.dev_apibindings.yaml
rule: (has(self.group) && self.group != '') || self.resource in
['configmaps', 'namespaces', 'secrets', 'serviceaccounts']
- message: .identityHash must be set if .group is not empty.
rule: '!(has(self.group) && self.group != '''') || (has(self.identityHash)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What's up with the ''''?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hm, probably not ideal, but does look like it still passes the identity hash test.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@sttts sttts sttts left review comments

@stevekuznetsov stevekuznetsov stevekuznetsov left review comments

@davidfestal davidfestal Awaiting requested review from davidfestal

Assignees

@sttts sttts

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

validate that the only resources without identity are known core types.
4 participants
@shawn-hurley @sttts @stevekuznetsov @openshift-merge-robot