Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of UI: Fix enabling replication capabilities bug into release/1.17.x #28375

Open
wants to merge 10 commits into
base: release/1.17.x
Choose a base branch
from

Conversation

hc-github-team-secure-vault-core
Copy link
Contributor

@hc-github-team-secure-vault-core hc-github-team-secure-vault-core commented Sep 12, 2024

Backport

This PR is a manual fix for the same thing as fixed in #28371. Due to changes in the replication area of the codebase between 1.17 and 1.18, the changes here are specific to 1.17 to minimize the amount of changes going into this release branch.

The below text is copied from the body of the original PR.


Description

A user with the policy below (which is used in this tutorial) was unable to enable replication in the GUI because the UI wasn't checking specifically for /dr/ or /performance/ in the original capabilities check.

// original check, path didn't include type
canEnablePrimary: this.store
        .findRecord('capabilities', 'sys/replication/primary/enable')
        .then((c) => c.canUpdate),
      canEnableSecondary: this.store
        .findRecord('capabilities', 'sys/replication/secondary/enable')
        .then((c) => c.canUpdate),

Now type is included in the path passed to the capabilities endpoint which hides or shows "Enable" accordingly. If there's a problem reading capabilities, then the default is true because the backend can be used as a fallback to gate a user who does not have the correct permissions.

I will open a manual backport to address this fix in 1.16 and 1.17 because the capabilities service is new and was added in 1.18


📸 The left is before the fix, and on the right is after.

Both browsers the user is logged in with the policy below.
Screenshot 2024-09-11 at 5 52 56 PM

# To enable DR primary
path "sys/replication/dr/primary/enable" {
  capabilities = ["create", "update"]
}

# To generate a secondary token required to add a DR secondary
path "sys/replication/dr/primary/secondary-token" {
  capabilities = ["create", "update", "sudo"]
}

# To create ACL policies
path "sys/policies/acl/*" {
  capabilities = ["create", "update", "list"]
}

# Create a token role for batch DR operation token
path "auth/token/roles/*" {
  capabilities = ["create", "update"]
}

# Create a token
path "auth/token/create" {
  capabilities = ["create", "update"]
}

# To demote the primary to secondary
path "sys/replication/dr/primary/demote" {
  capabilities = ["create", "update"]
}

# To enable DR secondary
path "sys/replication/dr/secondary/enable" {
  capabilities = ["create", "update"]
}

# To generate an operation token
path "sys/replication/dr/secondary/generate-operation-token/*" {
  capabilities = ["create", "update"]
}

# To promote the secondary cluster to be primary
path "sys/replication/dr/secondary/promote" {
  capabilities = ["create", "update"]
}

# To update the assigned primary cluster
path "sys/replication/dr/secondary/update-primary" {
  capabilities = ["create", "update"]
}

# If you choose to disable the original primary cluster post-recovery
path "sys/replication/dr/primary/disable" {
  capabilities = ["create", "update"]
}

  • Ent tests pass

@hc-github-team-secure-vault-core hc-github-team-secure-vault-core force-pushed the backport/ui/VAULT-30458/fix-enabling-replication-capabilities-bug/quickly-improved-amoeba branch from ff8f923 to a0339d9 Compare September 12, 2024 13:51
@github-actions github-actions bot added the hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed label Sep 12, 2024
Copy link

github-actions bot commented Sep 12, 2024

Build Results:
All builds succeeded! ✅

Copy link

CI Results: failed ❌

@hashishaw hashishaw added this to the 1.17.6 milestone Sep 12, 2024
@hashishaw hashishaw added the ui label Sep 12, 2024
@hashishaw hashishaw enabled auto-merge (squash) September 12, 2024 14:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
hashicorp-contributed-pr If the PR is HashiCorp (i.e. not-community) contributed ui
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants