Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Moving Access control from AKO to management-lib #321

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
+99 −677
Open

Moving Access control from AKO to management-lib #321

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e000d8c
Initial changes for refactoring acl code in lib
tanmayja Apr 3, 2024
5efb80e
Merge branch 'master' into refactoracl
tanmayja Jun 12, 2024
25b95a3
Merge branch 'master' into refactoracl
tanmayja Aug 26, 2024
1c46fc3
updating lib
tanmayja Aug 26, 2024
faf954e
Merge branch 'master' into refactoracl
tanmayja Oct 21, 2024
dfcedc3
Getting namespaces stats using management-lib.
tanmayja Oct 22, 2024
73390a4
Addressing comments
tanmayja Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 6 additions & 37 deletions api/v1/access_control_validate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,17 +8,7 @@ import (
"strings"

lib "github.com/aerospike/aerospike-management-lib"
)

// PrivilegeScope enumerates valid scopes for privileges.
type PrivilegeScope int

const (
// Global scoped privileges.
Global PrivilegeScope = iota

// NamespaceSet is namespace and optional set scoped privilege.
NamespaceSet
acl "github.com/aerospike/aerospike-management-lib/accesscontrol"
)

const (
Expand Down Expand Up @@ -71,27 +61,6 @@ var requiredRoles = []string{
"user-admin",
}

// Privileges are all privilege string allowed in the spec and associated scopes.
var Privileges = map[string][]PrivilegeScope{
"read": {Global, NamespaceSet},
"write": {Global, NamespaceSet},
"read-write": {Global, NamespaceSet},
"read-write-udf": {Global, NamespaceSet},
"data-admin": {Global},
"sys-admin": {Global},
"user-admin": {Global},
"truncate": {Global, NamespaceSet},
"sindex-admin": {Global},
"udf-admin": {Global},
}

// Post6Privileges are post version 6.0 privilege strings allowed in the spec and associated scopes.
var Post6Privileges = map[string][]PrivilegeScope{
"truncate": {Global, NamespaceSet},
"sindex-admin": {Global},
"udf-admin": {Global},
}

// IsAerospikeAccessControlValid validates the accessControl specification in the clusterSpec.
//
// Asserts that the AerospikeAccessControlSpec
Expand Down Expand Up @@ -316,7 +285,7 @@ func isPrivilegeValid(
) (bool, error) {
parts := strings.Split(privilege, ".")

_, ok := Privileges[parts[0]]
_, ok := acl.Privileges[parts[0]]
if !ok {
return false, fmt.Errorf("invalid privilege %s", privilege)
}
Expand All @@ -328,7 +297,7 @@ func isPrivilegeValid(
}

if cmp < 0 {
if _, ok := Post6Privileges[parts[0]]; ok {
if _, ok := acl.Post6Privileges[parts[0]]; ok {
// Version < 6.0 using post 6.0 privilege.
return false, fmt.Errorf("invalid privilege %s", privilege)
}
Expand All @@ -342,9 +311,9 @@ func isPrivilegeValid(

if nParts > 1 {
// This privilege should necessarily have NamespaceSet scope.
scopes := Privileges[parts[0]]
scopes := acl.Privileges[parts[0]]

if !scopeContains(scopes, NamespaceSet) {
if !scopeContains(scopes, acl.NamespaceSet) {
return false, fmt.Errorf(
"privilege %s cannot have namespace or set scope", privilege,
)
Expand Down Expand Up @@ -399,7 +368,7 @@ func isNetAddressValid(address string) (bool, error) {
}

// scopeContains indicates if scopes contains the queryScope.
func scopeContains(scopes []PrivilegeScope, queryScope PrivilegeScope) bool {
func scopeContains(scopes []acl.PrivilegeScope, queryScope acl.PrivilegeScope) bool {
for _, scope := range scopes {
if scope == queryScope {
return true
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module github.com/aerospike/aerospike-kubernetes-operator
go 1.22

require (
github.com/aerospike/aerospike-management-lib v1.5.0
github.com/aerospike/aerospike-management-lib v1.5.1-0.20241022182350-ec5a19ae3dc9
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
github.com/evanphx/json-patch v4.12.0+incompatible
github.com/go-logr/logr v1.4.2
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,8 @@ github.com/aerospike/aerospike-backup-service v0.0.0-20240822110128-dc2b4811b9d3
github.com/aerospike/aerospike-backup-service v0.0.0-20240822110128-dc2b4811b9d3/go.mod h1:PFWhqxcMsEEyoOZtQ70b+X8xWbbemDYuitT24EPBizk=
github.com/aerospike/aerospike-client-go/v7 v7.6.1 h1:VZK6S9YKq2w6ptTk3kXXjTxG2U9M9Y7Oi3YQ+3T7wQQ=
github.com/aerospike/aerospike-client-go/v7 v7.6.1/go.mod h1:uCbSYMpjlRcH/9f26VSF/luzDDXrcDaV8c6/WIcKtT4=
github.com/aerospike/aerospike-management-lib v1.5.0 h1:uAEaBU+PkzbtwsSrPVokLIUeJaDrFSMtwqeCKba3xIs=
github.com/aerospike/aerospike-management-lib v1.5.0/go.mod h1:hsEptY/AmTmHoJnItJNmfJ4yCMG8LIB8YPnIpIyvGXI=
github.com/aerospike/aerospike-management-lib v1.5.1-0.20241022182350-ec5a19ae3dc9 h1:GGYS+xSZyzxeZQ42e+8fcfGWH32B7gJszs3T6ZD19Lk=
github.com/aerospike/aerospike-management-lib v1.5.1-0.20241022182350-ec5a19ae3dc9/go.mod h1:Pbejci/QaooN6XW3FZwfv7qTidHOs+r8XgJ0Onw2xi4=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d h1:Byv0BzEl3/e6D5CLfI0j/7hiIEtvGVFPCZ7Ei2oq8iQ=
Expand Down
Loading
Loading