Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow --no-rbac flag that allows users to not pass rbac config #9972

Merged
merged 5 commits into from
Mar 25, 2022
Merged

Allow --no-rbac flag that allows users to not pass rbac config #9972

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
aeae0c4
Allow --no-rbac flag that allows users to not pass rbac config
notfelineit Mar 24, 2022
ad65112
Address PR comments
notfelineit Mar 24, 2022
ed974bc
Update go/cmd/vtadmin/main.go
notfelineit Mar 24, 2022
4c03621
Remove [rbac] prefix in error mssging
notfelineit Mar 24, 2022
f04bb55
Merge branch 'main' of github.com:vitessio/vitess into frances-no-rbac
notfelineit Mar 24, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 12 additions & 12 deletions go/cmd/vtadmin/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,8 @@ var (
defaultClusterConfig cluster.Config

rbacConfigPath string
enableRbac bool
disableRbac bool
enableRBAC bool
disableRBAC bool

traceCloser io.Closer = &noopCloser{}

Expand Down Expand Up @@ -103,19 +103,19 @@ func run(cmd *cobra.Command, args []string) {
}

var rbacConfig *rbac.Config
if !disableRbac && !enableRbac {
fatal("must explicitly enable or disable RBAC by passing --no-rbac or --rbac")
}
if enableRbac && !disableRbac && rbacConfigPath != "" {
if disableRBAC {
rbacConfig = rbac.DefaultConfig()
} else if enableRBAC && rbacConfigPath != "" {
cfg, err := rbac.LoadConfig(rbacConfigPath)
if err != nil {
fatal(err)
}

rbacConfig = cfg
}
if disableRbac && !enableRbac {
rbacConfig = rbac.DefaultConfig()
} else if enableRBAC && rbacConfigPath == "" {
fatal("[rbac] must pass --rbac-config path when enabling rbac")
notfelineit marked this conversation as resolved.
Show resolved Hide resolved
} else {
fatal("[rbac] must explicitly enable or disable RBAC by passing --no-rbac or --rbac")
notfelineit marked this conversation as resolved.
Show resolved Hide resolved
notfelineit marked this conversation as resolved.
Show resolved Hide resolved
}

for i, cfg := range configs {
Expand Down Expand Up @@ -170,9 +170,9 @@ func main() {
rootCmd.Flags().BoolVar(&httpOpts.EnableDynamicClusters, "http-enable-dynamic-clusters", false, "whether to enable dynamic clusters that are set by request header cookies")

// rbac flags
rootCmd.Flags().StringVar(&rbacConfigPath, "rbac-config", "rbac.yaml", "")
rootCmd.Flags().BoolVar(&enableRbac, "rbac", false, "whether to enable rbac")
rootCmd.Flags().BoolVar(&disableRbac, "no-rbac", false, "whether to disable rbac")
rootCmd.Flags().StringVar(&rbacConfigPath, "rbac-config", "", "path to an RBAC config file. must be set if passing --rbac")
rootCmd.Flags().BoolVar(&enableRBAC, "rbac", false, "whether to enable rbac. must be set if not passing --rbac")
rootCmd.Flags().BoolVar(&disableRBAC, "no-rbac", false, "whether to disable rbac. must be set if not passing --no-rbac")
notfelineit marked this conversation as resolved.
Show resolved Hide resolved

// glog flags, no better way to do this
rootCmd.Flags().AddGoFlag(flag.Lookup("v"))
Expand Down
4 changes: 3 additions & 1 deletion go/vt/vtadmin/rbac/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,9 +164,11 @@ func (c *Config) GetAuthorizer() *Authorizer {
return c.authorizer
}

// DefaultConfig returns a default config that allows all actions on all resources
// It is mainly used in the case where users explicitly pass --no-rbac flag.
func DefaultConfig() *Config {
notfelineit marked this conversation as resolved.
Show resolved Hide resolved
log.Info("[rbac]: using default rbac configuration")
actions := []string{"get", "create", "delete", "put", "ping"}
actions := []string{string(GetAction), string(CreateAction), string(DeleteAction), string(PutAction), string(PingAction)}
subjects := []string{"*"}
clusters := []string{"*"}

Expand Down