Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Authorization refactor in preparation for fine-grained authorization #12313

Merged
merged 55 commits into from
Oct 25, 2023
Merged

Authorization refactor in preparation for fine-grained authorization #12313

Changes from 1 commit
Commits
Show all changes
55 commits
Select commit Hold shift + click to select a range
5017205
lxd/auth: Adds entitlement, object, and permission types and constants.
markylaing Sep 25, 2023
3ea15d2
lxd/auth: Adds functions for creating auth objects.
markylaing Sep 25, 2023
a52e978
lxd/auth: Adds tests for authorization objects.
markylaing Oct 9, 2023
1ec0160
lxd/auth: Extends the authorizer interface.
markylaing Sep 25, 2023
cfa3b77
lxd/auth: Update common authorizer for Authorizer interface extension.
markylaing Sep 25, 2023
9123f14
lxd/auth: Implement Authorizer for TLS driver.
markylaing Sep 25, 2023
822af45
lxd/auth: Implement Authorizer for RBAC driver.
markylaing Sep 25, 2023
a39a702
lxd: Do not set user access data in request context.
markylaing Sep 25, 2023
c2c5840
lxd: Update calls to auth package.
markylaing Sep 25, 2023
dbad9e2
lxd: Only allow missing access handler when AllowUntrusted is true.
markylaing Sep 25, 2023
7b250a6
lxd: Update allowPermission function.
markylaing Sep 25, 2023
fd9d911
lxd: Updates allowAuthenticated function.
markylaing Oct 19, 2023
d428bc7
lxd/db/operationtype: Updates Permission method.
markylaing Sep 25, 2023
67d9725
lxd/operations: Updates operation permissions.
markylaing Sep 25, 2023
154c204
lxd/db/cluster: Renames constants.go file.
markylaing Sep 27, 2023
1fb2633
lxd/db/cluster: Add storage bucket entity type.
markylaing Sep 27, 2023
7362589
lxd/db/cluster: Adds URLToEntityType function.
markylaing Sep 27, 2023
1e22bcb
lxd/db/cluster: Adds a unit test for the URLToEntityType function.
markylaing Sep 27, 2023
3abd114
lxd/project: Updates permission handling for projects.
markylaing Sep 25, 2023
8975800
lxd/project: Updates permissions tests.
markylaing Oct 20, 2023
f0b0dcc
lxd/events: Pass an auth.PermissionChecker into the event listener.
markylaing Sep 25, 2023
fbd635b
lxd-agent: Update call to AddListener for the LXD Agent.
markylaing Sep 25, 2023
74aa566
lxd: Update authorization for the /1.0 endpoint.
markylaing Sep 25, 2023
2db6fe5
lxd: Update authorization for cluster endpoints.
markylaing Sep 25, 2023
aa061f8
lxd: Update authorization for internal endpoints.
markylaing Sep 25, 2023
9306e35
lxd/metrics: Adds method to filter metrics with a permission checker.
markylaing Sep 25, 2023
ae092f4
lxd: Update authorization for metrics.
markylaing Sep 25, 2023
4cb57a1
lxd: Update authorization for projects API.
markylaing Sep 25, 2023
535c040
lxd: Updates authorization for certificates API.
markylaing Sep 25, 2023
f1bb54a
lxd: Updates authorization for events API.
markylaing Sep 25, 2023
0cc2aa3
lxd: Updates authorization for image API.
markylaing Sep 25, 2023
73a9ce3
lxd: Add/remove images and image aliases from authorizer.
markylaing Sep 25, 2023
46698f1
lxd: Update authorization for instances.
markylaing Sep 25, 2023
146f36c
lxd/instance/drivers: Add/remove/rename instances in authorizer.
markylaing Sep 25, 2023
cacb832
lxd: Update authorization for network ACL API.
markylaing Sep 25, 2023
8b494ab
lxd: Update network ACLs in the authorizer.
markylaing Sep 25, 2023
721e31a
lxd: Update authorization for network allocations.
markylaing Sep 25, 2023
444692e
lxd: Update authorization for network forwards.
markylaing Sep 25, 2023
c2ef675
lxd: Update authorization for network load balancers.
markylaing Sep 25, 2023
3147031
lxd: Update authorization for network peers.
markylaing Sep 25, 2023
92408de
lxd: Update authorization for network zones.
markylaing Sep 25, 2023
cb5919f
lxd: Update network zones in the authorizer.
markylaing Sep 25, 2023
ca20445
lxd: Update authorization for the networks API.
markylaing Sep 25, 2023
31df5be
lxd: Update networks in the authorizer.
markylaing Sep 25, 2023
8ee727e
lxd: Update authorization for operations.
markylaing Sep 25, 2023
d9322ff
lxd: Update authorization for profiles.
markylaing Sep 25, 2023
6000337
lxd: Update profiles in authorizer.
markylaing Sep 25, 2023
cac36ee
lxd: Update authorization for resources.
markylaing Sep 25, 2023
2d3a73c
lxd: Update authorization for storage buckets.
markylaing Sep 25, 2023
0c43e90
lxd: Update storage buckets in authorizer.
markylaing Sep 25, 2023
27d6fe4
lxd: Update authorization for storage pools.
markylaing Sep 25, 2023
2ff65b0
lxd: Update storage pools in authorizer.
markylaing Sep 25, 2023
cb9da5d
lxd: Update authorization for storage volumes.
markylaing Sep 25, 2023
3371cf9
lxd/storage: Add/Remove/Rename storage volumes in authorizer.
markylaing Sep 25, 2023
7c9f699
lxd: Update authorization for warnings.
markylaing Sep 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 14 additions & 8 deletions lxd/daemon.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -714,7 +714,7 @@ func (d *Daemon) init() error {
var dbWarnings []dbCluster.Warning

// Set default authorizer.
d.authorizer, err = auth.LoadAuthorizer("tls", nil, logger.Log, nil)
d.authorizer, err = auth.LoadAuthorizer(d.shutdownCtx, auth.DriverTLS, logger.Log, d.clientCerts)
if err != nil {
return err
}
Expand Down Expand Up @@ -1803,14 +1803,17 @@ func (d *Daemon) setupRBACServer(rbacURL string, rbacKey string, rbacExpiry int6
var err error
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think in general we should rework this function to be a generic "one of the authorization keys has changed, we need to restart/change the authorization driver" and have it handle all the driver's config keys so it can fallback to the previous active driver (and not just TLS) on error. But this can come as a separate PR.


if d.authorizer != nil {
d.authorizer.StopStatusCheck()
err := d.authorizer.StopService(d.shutdownCtx)
if err != nil {
logger.Error("Failed to stop authorizer service", logger.Ctx{"error": err})
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should return an error here rather than logging right? Otherwise we can get into an inconsistent state?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Or do we also need to fallback to TLS in that case?

}
}

if rbacURL == "" || rbacAgentURL == "" || rbacAgentUsername == "" || rbacAgentPrivateKey == "" || rbacAgentPublicKey == "" {
d.candidVerifier = nil

// Reset to default authorizer.
d.authorizer, err = auth.LoadAuthorizer("tls", nil, logger.Log, nil)
d.authorizer, err = auth.LoadAuthorizer(d.shutdownCtx, auth.DriverTLS, logger.Log, d.clientCerts)
if err != nil {
return err
}
Expand All @@ -1821,9 +1824,9 @@ func (d *Daemon) setupRBACServer(rbacURL string, rbacKey string, rbacExpiry int6
revert := revert.New()
defer revert.Fail()

projectsFunc := func() (map[int64]string, error) {
projectsFunc := func(ctx context.Context) (map[int64]string, error) {
var result map[int64]string
err := d.State().DB.Cluster.Transaction(context.TODO(), func(ctx context.Context, tx *db.ClusterTx) error {
err := d.State().DB.Cluster.Transaction(ctx, func(ctx context.Context, tx *db.ClusterTx) error {
var err error
result, err = dbCluster.GetProjectIDsToNames(ctx, tx.Tx())
return err
Expand All @@ -1847,18 +1850,21 @@ func (d *Daemon) setupRBACServer(rbacURL string, rbacKey string, rbacExpiry int6
d.candidVerifier = nil

// Reset to default authorizer.
d.authorizer, _ = auth.LoadAuthorizer("tls", nil, logger.Log, nil)
d.authorizer, _ = auth.LoadAuthorizer(d.shutdownCtx, auth.DriverTLS, logger.Log, d.clientCerts)
})

// Load RBAC authorizer
rbacAuthorizer, err := auth.LoadAuthorizer("rbac", config, logger.Log, projectsFunc)
rbacAuthorizer, err := auth.LoadAuthorizer(d.shutdownCtx, auth.DriverRBAC, logger.Log, d.clientCerts, auth.WithConfig(config), auth.WithProjectsGetFunc(projectsFunc))
if err != nil {
return err
}

revert.Add(func() {
// Stop status check in case candid fails.
rbacAuthorizer.StopStatusCheck()
err := rbacAuthorizer.StopService(d.shutdownCtx)
if err != nil {
logger.Error("Failed to stop authorizer service", logger.Ctx{"error": err})
}
})

// Enable candid authentication
Expand Down