-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: use Keto 0.11 for authorization (#89)
* feat: use Keto 0.11 for authorization Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * feat: add boostrap and serving command to mlp binary Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * feat: Invoke serve command by default if none is specified * fix: add additional comments to authorization update request, and update the method naming Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * fix: Use constant string for predefined roles Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * fix: Use singular form for permission lookup / store Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * fix: Use input files for keto bootstrap command Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * feat: add comment to role member expansion Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * feat: add get user permissions method to enforcer Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * fix: use role template strings for predefined roles Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * fix: remove unnecessary error handling Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> * fix: use separate config for bootstrap command Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> --------- Signed-off-by: Khor Shu Heng <khor.heng@gojek.com> Co-authored-by: Khor Shu Heng <khor.heng@gojek.com>
- Loading branch information
1 parent
dd63f43
commit 1d8bbbc
Showing
32 changed files
with
1,335 additions
and
1,273 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "context" | ||
|
|
||
| "github.com/knadh/koanf" | ||
| "github.com/knadh/koanf/parsers/yaml" | ||
| "github.com/knadh/koanf/providers/file" | ||
|
|
||
| "github.com/spf13/cobra" | ||
|
|
||
| "github.com/caraml-dev/mlp/api/log" | ||
| "github.com/caraml-dev/mlp/api/pkg/authz/enforcer" | ||
| ) | ||
|
|
||
| type BootstrapConfig struct { | ||
| KetoRemoteRead string | ||
| KetoRemoteWrite string | ||
| ProjectReaders []string | ||
| MLPAdmins []string | ||
| } | ||
|
|
||
| var ( | ||
| bootstrapConfigFile string | ||
| bootstrapCmd = &cobra.Command{ | ||
| Use: "bootstrap", | ||
| Short: "Start bootstrap job to populate Keto", | ||
| Run: func(cmd *cobra.Command, args []string) { | ||
| bootstrapConfig, err := loadBootstrapConfig(bootstrapConfigFile) | ||
| if err != nil { | ||
| log.Panicf("unable to load role members from input file: %v", err) | ||
| } | ||
| err = startKetoBootstrap(bootstrapConfig) | ||
| if err != nil { | ||
| log.Panicf("unable to bootstrap keto: %v", err) | ||
| } | ||
| }, | ||
| } | ||
| ) | ||
|
|
||
| func init() { | ||
| bootstrapCmd.Flags().StringVarP(&bootstrapConfigFile, "config", "c", "", | ||
| "Path to keto bootstrap configuration") | ||
| err := bootstrapCmd.MarkFlagRequired("config") | ||
| if err != nil { | ||
| log.Panicf("unable to mark flag as required: %v", err) | ||
| } | ||
| } | ||
|
|
||
| func loadBootstrapConfig(path string) (*BootstrapConfig, error) { | ||
| bootstrapCfg := &BootstrapConfig{ | ||
| ProjectReaders: []string{}, | ||
| MLPAdmins: []string{}, | ||
| } | ||
| k := koanf.New(".") | ||
| err := k.Load(file.Provider(path), yaml.Parser()) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| err = k.Unmarshal("", bootstrapCfg) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return bootstrapCfg, nil | ||
| } | ||
|
|
||
| func startKetoBootstrap(bootstrapCfg *BootstrapConfig) error { | ||
| authEnforcer, err := enforcer.NewEnforcerBuilder(). | ||
| KetoEndpoints(bootstrapCfg.KetoRemoteRead, bootstrapCfg.KetoRemoteWrite). | ||
| Build() | ||
| if err != nil { | ||
| return err | ||
| } | ||
| updateRequest := enforcer.NewAuthorizationUpdateRequest() | ||
| updateRequest.SetRoleMembers(enforcer.MLPProjectsReaderRole, bootstrapCfg.ProjectReaders) | ||
| updateRequest.SetRoleMembers(enforcer.MLPAdminRole, bootstrapCfg.MLPAdmins) | ||
| return authEnforcer.UpdateAuthorization(context.Background(), updateRequest) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package cmd | ||
|
|
||
| import ( | ||
| "os" | ||
|
|
||
| "github.com/spf13/cobra" | ||
| "github.com/spf13/pflag" | ||
|
|
||
| "github.com/caraml-dev/mlp/api/log" | ||
| ) | ||
|
|
||
| var ( | ||
| rootCmd = &cobra.Command{ | ||
| Use: "mlp", | ||
| Short: "CaraML Machine Learning Platform Console", | ||
| Long: "CaraML Machine Learning Platform Console, which provides a web UI to interact with different CaraML " + | ||
| "services. If no subcommand are provided, serve command will be run as default.", | ||
| } | ||
| ) | ||
|
|
||
| func init() { | ||
| rootCmd.AddCommand(serveCmd) | ||
| rootCmd.AddCommand(bootstrapCmd) | ||
| } | ||
|
|
||
| func Execute() { | ||
| cmd, _, err := rootCmd.Find(os.Args[1:]) | ||
| // use serve as default cmd if no cmd is given | ||
| if err == nil && cmd.Use == rootCmd.Use && cmd.Flags().Parse(os.Args[1:]) != pflag.ErrHelp { | ||
| args := append([]string{serveCmd.Use}, os.Args[1:]...) | ||
| rootCmd.SetArgs(args) | ||
| } | ||
|
|
||
| err = rootCmd.Execute() | ||
| if err != nil { | ||
| log.Fatalf("failed executing root command: %v", err) | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.