feat: Advanced authorization #1789

tolusha · 2023-11-28T15:57:40Z

What does this PR do?

feat: Advanced authorization

Screenshot/screencast of this PR

N/A

What issues does this PR fix or reference?

https://issues.redhat.com/browse/CRW-4805

How to test this PR?

Prepare a patch file if needed:

cat > /tmp/cr-patch.yaml <<EOF
apiVersion: org.eclipse.che/v2
kind: CheCluster
spec:
  components:
    cheServer:
      deployment:
        containers:
        - image: quay.io/eclipse/che-server:pr-619
EOF

Deploy the operator:

OpenShift

# user{x}:password
cat > /tmp/test-htpasswd <<EOF
user1:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=
user2:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=
user3:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=
user4:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=
user5:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=
EOF
oc create secret generic test-htpass-secret --from-file=htpasswd=/tmp/test-htpasswd -n openshift-config
oc patch oauth cluster --type=merge -p '{"spec":{"identityProviders":[{"htpasswd":{"fileData":{"name":"test-htpass-secret"}},"mappingMethod":"claim","name":"test-htpasswd","type":"HTPasswd"}]}}'

oc apply -f - <<EOF
apiVersion: user.openshift.io/v1
kind: Group
metadata:
  name: test-group-1
users:
  - user1
EOF
  
oc apply -f - <<EOF
apiVersion: user.openshift.io/v1
kind: Group
metadata:
  name: test-group-2
users:
  - user3
EOF

./build/scripts/olm/test-catalog-from-sources.sh --cr-patch-yaml /tmp/cr-patch.yaml

oc patch checluster eclipse-che -n eclipse-che --type=merge -p='{"spec":{"networking":{"auth":{"advancedAuthorization":{"allowGroups":["test-group-1"],"allowUsers":["user2"],"denyGroups":["test-group-2"],"denyUsers":["user4","user5"]}}}}}'

on Minikube

./build/scripts/minikube-tests/test-operator-from-sources.sh --cr-patch-yaml /tmp/cr-patch.yaml

kubectl patch checluster eclipse-che -n eclipse-che --type=merge -p='{"spec":{"networking":{"auth":{"advancedAuthorization":{"allowUsers":["user1", "user2"],"denyUsers":["user3", "user4","user5"]}}}}}'

Validation steps
Users user1 and user2 are allowed to access Che.
Users user3, user4 and user5 are disallowed to access Che

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

Signed-off-by: Anatolii Bazko <[email protected]>

openshift-ci · 2023-11-28T15:57:46Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

codecov · 2023-11-28T16:01:06Z

Codecov Report

Attention: 40 lines in your changes are missing coverage. Please review.

Comparison is base (14eed75) 59.53% compared to head (3bde4f2) 59.46%.
Report is 2 commits behind head on main.

Files	Patch %	Lines
api/v2/zz_generated.deepcopy.go	0.00%	34 Missing ⚠️
pkg/deploy/server/server_configmap.go	25.00%	5 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1789      +/-   ##
==========================================
- Coverage   59.53%   59.46%   -0.08%     
==========================================
  Files          71       71              
  Lines        8605     8703      +98     
==========================================
+ Hits         5123     5175      +52     
- Misses       3131     3172      +41     
- Partials      351      356       +5

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: Anatolii Bazko <[email protected]>

tolusha · 2023-12-01T09:56:01Z

/retest

Signed-off-by: Anatolii Bazko <[email protected]>

amisevsk

LGTM; haven't tested changes.

To double check -- these changes (along with the server-side changes) won't block access to the dashboard / gateway, correct?

amisevsk · 2023-12-01T20:04:02Z

config/rbac/cluster_role.yaml

+  - apiGroups:
+      - user.openshift.io
+    resources:
+      - groups
+    verbs:
+      - get


Just wondering -- does the Che Operator not use +kubebuilder:rbac markers to define controller permissions?

We don't use annotations like this to define permissions.

amisevsk · 2023-12-01T20:09:45Z

pkg/deploy/server/rbac.go

+		{
+			APIGroups: []string{""},
+			Resources: []string{"serviceaccounts"},
+			Verbs:     []string{"get", "watch", "create"},
+		},
+		{
+			APIGroups: []string{"rbac.authorization.k8s.io"},
+			Resources: []string{"roles"},
+			Verbs:     []string{"get", "create", "update"},
+		},
+		{
+			APIGroups: []string{"rbac.authorization.k8s.io"},
+			Resources: []string{"rolebindings"},
+			Verbs:     []string{"get", "create", "update", "delete"},
+		},


I'm not sure I understand the three functions here any why they are separated; these all apply to the Che server SA, right?

Operator delegates permissions to a che-server SA and the che-server SA delegates permissions to a user.
But some permissions are only needed for the che-server SA and not for the user.
That's we have separation for cluster roles: some permissions for the user and some permissions only for che-server SA. I hope I was clear.

Maybe some permissions are redundant since moving to the Dev Workspace engine.
But I am not sure right now.

👍 makes sense, thanks.

tolusha · 2023-12-04T10:21:44Z

/retest

tolusha · 2023-12-04T11:18:21Z

@amisevsk

To double check -- these changes (along with the server-side changes) won't block access to the dashboard / gateway, correct?

You are right, it doesn't block any access to dashboard/gateway.

openshift-ci · 2023-12-04T11:33:25Z

@tolusha: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v12-devworkspace-happy-path	`f499799`	link	true	`/test v12-devworkspace-happy-path`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci · 2023-12-04T13:35:32Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: amisevsk, ibuziuk, tolusha

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

devstudio-release · 2023-12-04T16:09:41Z

Build 3.11 :: operator_3.x/327: Console, Changes, Git Data

devstudio-release · 2023-12-04T16:16:46Z

Build 3.11 :: sync-to-downstream_3.x/5495: Console, Changes, Git Data

devstudio-release · 2023-12-04T16:22:42Z

Build 3.11 :: get-sources-rhpkg-container-build_3.x/5374: Console, Changes, Git Data

devstudio-release · 2023-12-05T03:54:59Z

Build 3.11 :: operator-bundle_3.x/2364: Console, Changes, Git Data

devstudio-release · 2023-12-05T03:58:44Z

Build 3.11 :: sync-to-downstream_3.x/5504: Console, Changes, Git Data

devstudio-release · 2023-12-05T03:59:14Z

Build 3.11 :: get-sources-rhpkg-container-build_3.x/5383: Console, Changes, Git Data

devstudio-release · 2023-12-05T04:05:12Z

Build 3.11 :: push-latest-container-to-quay_3.x/3866: Console, Changes, Git Data

devstudio-release · 2023-12-05T04:06:41Z

Build 3.11 :: copyIIBsToQuay/2258: Console, Changes, Git Data

devstudio-release · 2023-12-05T04:07:48Z

Build 3.11 :: get-sources-rhpkg-container-build_3.x/5383:

devspaces-operator-bundle : 3.x :: Build 57379653 : quay.io/devspaces/devspaces-operator-bundle:3.11-138
SUCCESS; copied to quay; /DS_CI/push-latest-container-to-quay_3.x/3866 triggered;
Bundle CSV related images:
- quay.io/devspaces/code-rhel8:3.11-50
- quay.io/devspaces/configbump-rhel8:3.11-8
- quay.io/devspaces/dashboard-rhel8:3.11-43
- quay.io/devspaces/devfileregistry-rhel8:3.11-34
- quay.io/devspaces/devspaces-rhel8-operator:3.11-17
- quay.io/devspaces/idea-rhel8:3.11-5
- quay.io/devspaces/pluginregistry-rhel8:3.11-8
- quay.io/devspaces/server-rhel8:3.11-22
- quay.io/devspaces/traefik-rhel8:3.11-4
- quay.io/devspaces/udi-rhel8:3.11-12
= registry.redhat.io/openshift4/ose-kube-rbac-proxy:v4.12.0-202311021630.p0.gb17014f.assembly.stream
= registry.redhat.io/openshift4/ose-oauth-proxy:v4.12.0-202311021630.p0.g03e5b13.assembly.stream
= registry.redhat.io/rhscl/mongodb-36-rhel7:1-50
= registry.redhat.io/ubi8/ubi-minimal:8.8-1072.1697626218

devstudio-release · 2023-12-05T04:07:51Z

Build 3.11 :: sync-to-downstream_3.x/5504:

Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/5383 triggered; /job/DS_CI/job/dsc_3.x triggered;

devstudio-release · 2023-12-05T04:07:53Z

Build 3.11 :: operator-bundle_3.x/2364:

Upstream sync done; /DS_CI/sync-to-downstream_3.x/5504 triggered

devstudio-release · 2023-12-05T04:11:27Z

Build 3.11 :: dsc_3.x/1630: Console, Changes, Git Data

devstudio-release · 2023-12-05T04:21:09Z

Build 3.11 :: dsc_3.x/1630:

3.11.0-CI

devstudio-release · 2023-12-05T19:26:15Z

Build 3.11 :: operator-bundle_3.x/2365: Console, Changes, Git Data

devstudio-release · 2023-12-05T19:30:13Z

Build 3.11 :: sync-to-downstream_3.x/5506: Console, Changes, Git Data

devstudio-release · 2023-12-05T19:30:44Z

Build 3.11 :: get-sources-rhpkg-container-build_3.x/5385: Console, Changes, Git Data

devstudio-release · 2023-12-05T19:35:49Z

Build 3.11 :: push-latest-container-to-quay_3.x/3868: Console, Changes, Git Data

devstudio-release · 2023-12-05T19:37:21Z

Build 3.11 :: copyIIBsToQuay/2259: Console, Changes, Git Data

devstudio-release · 2023-12-05T19:38:42Z

Build 3.11 :: get-sources-rhpkg-container-build_3.x/5385:

devspaces-operator-bundle : 3.x :: Build 57393127 : quay.io/devspaces/devspaces-operator-bundle:3.11-139
SUCCESS; copied to quay; /DS_CI/push-latest-container-to-quay_3.x/3868 triggered;
Bundle CSV related images:
- quay.io/devspaces/code-rhel8:3.11-51
- quay.io/devspaces/configbump-rhel8:3.11-8
- quay.io/devspaces/dashboard-rhel8:3.11-43
- quay.io/devspaces/devfileregistry-rhel8:3.11-34
- quay.io/devspaces/devspaces-rhel8-operator:3.11-17
- quay.io/devspaces/idea-rhel8:3.11-5
- quay.io/devspaces/pluginregistry-rhel8:3.11-8
- quay.io/devspaces/server-rhel8:3.11-22
- quay.io/devspaces/traefik-rhel8:3.11-4
- quay.io/devspaces/udi-rhel8:3.11-12
= registry.redhat.io/openshift4/ose-kube-rbac-proxy:v4.12.0-202311021630.p0.gb17014f.assembly.stream
= registry.redhat.io/openshift4/ose-oauth-proxy:v4.12.0-202311021630.p0.g03e5b13.assembly.stream
= registry.redhat.io/rhscl/mongodb-36-rhel7:1-50
= registry.redhat.io/ubi8/ubi-minimal:8.8-1072.1697626218

devstudio-release · 2023-12-05T19:38:45Z

Build 3.11 :: sync-to-downstream_3.x/5506:

Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/5385 triggered; /job/DS_CI/job/dsc_3.x triggered;

devstudio-release · 2023-12-05T19:38:47Z

Build 3.11 :: operator-bundle_3.x/2365:

Upstream sync done; /DS_CI/sync-to-downstream_3.x/5506 triggered

devstudio-release · 2023-12-05T19:40:26Z

Build 3.11 :: dsc_3.x/1631: Console, Changes, Git Data

devstudio-release · 2023-12-05T19:48:47Z

Build 3.11 :: dsc_3.x/1631:

3.11.0-CI

devstudio-release · 2023-12-05T22:36:48Z

Build 3.11 :: operator-bundle_3.x/2366: Console, Changes, Git Data

devstudio-release · 2023-12-05T22:40:34Z

Build 3.11 :: sync-to-downstream_3.x/5509: Console, Changes, Git Data

devstudio-release · 2023-12-05T22:41:03Z

Build 3.11 :: get-sources-rhpkg-container-build_3.x/5388: Console, Changes, Git Data

devstudio-release · 2023-12-05T22:46:22Z

Build 3.11 :: push-latest-container-to-quay_3.x/3870: Console, Changes, Git Data

devstudio-release · 2023-12-05T22:47:51Z

Build 3.11 :: copyIIBsToQuay/2260: Console, Changes, Git Data

devstudio-release · 2023-12-05T22:49:13Z

Build 3.11 :: get-sources-rhpkg-container-build_3.x/5388:

devspaces-operator-bundle : 3.x :: Build 57395199 : quay.io/devspaces/devspaces-operator-bundle:3.11-140
SUCCESS; copied to quay; /DS_CI/push-latest-container-to-quay_3.x/3870 triggered;
Bundle CSV related images:
- quay.io/devspaces/code-rhel8:3.11-51
- quay.io/devspaces/configbump-rhel8:3.11-8
- quay.io/devspaces/dashboard-rhel8:3.11-43
- quay.io/devspaces/devfileregistry-rhel8:3.11-35
- quay.io/devspaces/devspaces-rhel8-operator:3.11-17
- quay.io/devspaces/idea-rhel8:3.11-5
- quay.io/devspaces/pluginregistry-rhel8:3.11-8
- quay.io/devspaces/server-rhel8:3.11-22
- quay.io/devspaces/traefik-rhel8:3.11-4
- quay.io/devspaces/udi-rhel8:3.11-12
= registry.redhat.io/openshift4/ose-kube-rbac-proxy:v4.12.0-202311021630.p0.gb17014f.assembly.stream
= registry.redhat.io/openshift4/ose-oauth-proxy:v4.12.0-202311021630.p0.g03e5b13.assembly.stream
= registry.redhat.io/rhscl/mongodb-36-rhel7:1-50
= registry.redhat.io/ubi8/ubi-minimal:8.8-1072.1697626218

devstudio-release · 2023-12-05T22:49:16Z

Build 3.11 :: sync-to-downstream_3.x/5509:

Build container: devspaces-operator-bundle synced; /DS_CI/get-sources-rhpkg-container-build_3.x/5388 triggered; /job/DS_CI/job/dsc_3.x triggered;

devstudio-release · 2023-12-05T22:49:17Z

Build 3.11 :: operator-bundle_3.x/2366:

Upstream sync done; /DS_CI/sync-to-downstream_3.x/5509 triggered

devstudio-release · 2023-12-05T22:51:05Z

Build 3.11 :: dsc_3.x/1632: Console, Changes, Git Data

devstudio-release · 2023-12-05T22:59:28Z

Build 3.11 :: dsc_3.x/1632:

3.11.0-CI

feat: Advanced authorization

66d0d19

Signed-off-by: Anatolii Bazko <[email protected]>

openshift-ci bot added the do-not-merge/work-in-progress label Nov 28, 2023

tolusha mentioned this pull request Nov 29, 2023

feat: Advanced authorization eclipse-che/che-server#619

Merged

9 tasks

tolusha added 2 commits November 29, 2023 13:39

fixup

cd39f8e

Signed-off-by: Anatolii Bazko <[email protected]>

fixup

3bde4f2

Signed-off-by: Anatolii Bazko <[email protected]>

tolusha marked this pull request as ready for review November 29, 2023 14:07

tolusha requested review from nickboldt, ibuziuk and l0rd as code owners November 29, 2023 14:07

openshift-ci bot removed the do-not-merge/work-in-progress label Nov 29, 2023

tolusha added 2 commits November 30, 2023 14:32

Renames fields

421f3af

Signed-off-by: Anatolii Bazko <[email protected]>

Update comments

e96b60c

Signed-off-by: Anatolii Bazko <[email protected]>

fixup

f499799

Signed-off-by: Anatolii Bazko <[email protected]>

amisevsk approved these changes Dec 1, 2023

View reviewed changes

openshift-ci bot assigned amisevsk Dec 1, 2023

openshift-ci bot added the lgtm label Dec 1, 2023

ibuziuk approved these changes Dec 4, 2023

View reviewed changes

openshift-ci bot assigned ibuziuk Dec 4, 2023

tolusha merged commit d99f892 into main Dec 4, 2023
13 checks passed

tolusha deleted the CRW-4805 branch December 4, 2023 16:09

feat: Advanced authorization #1789

feat: Advanced authorization #1789

Conversation

tolusha commented Nov 28, 2023 • edited Loading

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

OpenShift

on Minikube

PR Checklist

Reviewers

openshift-ci bot commented Nov 28, 2023

codecov bot commented Nov 28, 2023 • edited Loading

Codecov Report

tolusha commented Dec 1, 2023

amisevsk left a comment

Choose a reason for hiding this comment

amisevsk Dec 1, 2023

Choose a reason for hiding this comment

tolusha Dec 4, 2023

Choose a reason for hiding this comment

amisevsk Dec 1, 2023

Choose a reason for hiding this comment

tolusha Dec 4, 2023

Choose a reason for hiding this comment

tolusha Dec 4, 2023

Choose a reason for hiding this comment

amisevsk Dec 4, 2023

Choose a reason for hiding this comment

tolusha commented Dec 4, 2023

tolusha commented Dec 4, 2023

openshift-ci bot commented Dec 4, 2023 • edited Loading

openshift-ci bot commented Dec 4, 2023

devstudio-release commented Dec 4, 2023

devstudio-release commented Dec 4, 2023

devstudio-release commented Dec 4, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

devstudio-release commented Dec 5, 2023

tolusha commented Nov 28, 2023 •

edited

Loading

codecov bot commented Nov 28, 2023 •

edited

Loading

openshift-ci bot commented Dec 4, 2023 •

edited

Loading