ACL: add ACL role functionality to ACL tokens #14110
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jrasell
force-pushed
the
f-gh-13120-acl-role-token-support
branch
from
6a6cddf
to
e4ddbd2
Compare
shoenig
approved these changes
Aug 15, 2022
Comment on lines
+254
to
+257
| // Track whether we have made an initial copy to ensure we are not | ||
| // operating on the token directly from state. | ||
| copied := false |
There was a problem hiding this comment.
Just an idea - this would probably be easier to read if we always created the duplicate, then compare hashes at then end to decide if we should return the duplicate or the original
jrasell
force-pushed
the
f-gh-13120-acl-role-token-support
branch
from
e4ddbd2
to
dc33c57
Compare
jrasell
force-pushed
the
f-gh-13120-acl-role-token-support
branch
from
dc33c57
to
907baf6
Compare
ACL tokens can now utilize ACL roles in order to provide API authorization. Each ACL token can be created and linked to an array of policies as well as an array of ACL role links. The link can be provided via the role name or ID, but internally, is always resolved to the ID as this is immutable whereas the name can be changed by operators. When resolving an ACL token, the policies linked from an ACL role are unpacked and combined with the policy array to form the complete auth set for the token. The ACL token creation endpoint handles deduplicating ACL role links as well as ensuring they exist within state. When reading a token, Nomad will also ensure the ACL role link is current. This handles ACL roles being deleted from under a token from a UX standpoint.
jrasell
force-pushed
the
f-gh-13120-acl-role-token-support
branch
from
a8a965d
to
4b9e2fc
Compare
jrasell
force-pushed
the
f-gh-13120-acl-role-token-support
branch
from
4b9e2fc
to
9953159
Compare
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
ACL tokens can now utilize ACL roles in order to provide API
authorization. Each ACL token can be created and linked to an
array of policies as well as an array of ACL role links. The link
can be provided via the role name or ID, but internally, is always
resolved to the ID as this is immutable whereas the name can be
changed by operators.
When resolving an ACL token, the policies linked from an ACL role
are unpacked and combined with the policy array to form the
complete auth set for the token.
The ACL token creation endpoint handles deduplicating ACL role
links as well as ensuring they exist within state.
When reading a token, Nomad will also ensure the ACL role link is
current. This handles ACL roles being deleted from under a token
from a UX standpoint.
The PR also includes adding the ability to create ACL tokens via
the CLI which link to ACL roles.
related: #13120
targets: feature branch