feat: additional RBAC configmaps #9976

notfromstatefarm · 2022-07-13T17:30:00Z

Signed-off-by: notfromstatefarm 86763948+notfromstatefarm@users.noreply.github.com

Note on DCO:

If the DCO action in the integration test fails, one or more of your commits are not signed off. Please click on the Details link next to the DCO action for instructions on how to resolve this.

Checklist:

Either (a) I've created an enhancement proposal and discussed it with the community, (b) this is a bug fix, or (c) this does not need to be in the release notes.
The title of the PR states what changed and the related issues number (used for the release note).
I've included "Closes [ISSUE #]" or "Fixes [ISSUE #]" in the description to automatically close the associated issue.
Does this PR require documentation updates?
I've updated documentation as required by this PR.
I have signed off all my commits as required by DCO
I have written unit and/or e2e tests for my change. PRs without these are unlikely to be merged.
My build is green (troubleshooting builds).

Closes #8324

This PR implements 'additional configmaps' for RBAC. Any configmaps with the label argocd.argoproj.io/cm-type=additional-rbac will be used and watched for changes. The policy.csv key is merged from all of them. This allows users to easily deploy new RBAC rules by simply deploying additional ConfigMaps.

This PR also introduces a new concept suggested by @crenshaw-dev: a standardized security field on logs where the value indicates severity/level of paranoia.

I've tested this locally and it works like a charm!

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

codecov · 2022-07-13T17:52:32Z

Codecov Report

Attention: 42 lines in your changes are missing coverage. Please review.

Comparison is base (179d1e0) 45.84% compared to head (8ede094) 45.84%.
Report is 1891 commits behind head on master.

Files	Patch %	Lines
util/rbac/rbac.go	32.75%	39 Missing ⚠️
util/oidc/oidc.go	80.00%	1 Missing and 1 partial ⚠️
cmd/argocd/commands/admin/settings_rbac.go	50.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9976      +/-   ##
==========================================
- Coverage   45.84%   45.84%   -0.01%     
==========================================
  Files         227      227              
  Lines       27095    27381     +286     
==========================================
+ Hits        12422    12553     +131     
- Misses      12974    13125     +151     
- Partials     1699     1703       +4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

util/rbac/rbac.go

docs/operator-manual/rbac.md

crenshaw-dev · 2022-07-15T16:08:31Z

util/rbac/rbac.go

+// newInformers returns an informer which watches updates on the rbac configmap
+func (e *Enforcer) newAdditionalInformer() cache.SharedIndexInformer {
+	tweakConfigMap := func(options *metav1.ListOptions) {
+		options.LabelSelector = "argocd.argoproj.io/cm-type=additional-rbac"


What happens if I remove the label? Will the policy be dropped from the combined policy?

since we are using v1.NewFilteredConfigMapInformer with our specified labelselector, it will drop the policy from combined policy:

time="2022-11-21T23:04:23Z" level=info msg="RBAC Additional ConfigMap 'argocd-rbac-cm-extra' deleted" security=2

docs/operator-manual/rbac.md

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

jessesuen · 2022-07-25T17:13:06Z

I thought the order of resolution of casbin rules was significant. How is this merging this in a predictable order?

jannfis · 2022-07-25T17:37:35Z

Hm, according to our Casbin model, we don't use any priority model. I think our model uses simple allow/deny patterns, with deny overriding any allow statement. But we should verify that.

jannfis · 2022-07-25T17:51:14Z

This change should also be reflected in the argocd admin settings rbac can command, which can operate from the live configuration to check certain RBAC constraints.

Probably

argo-cd/cmd/argocd/commands/admin/settings_rbac.go

Line 248 in 33fa916

cm, err := getPolicyConfigMap(ctx, kubeClient, namespace)

should return a concatenated version of all ConfigMaps

jannfis · 2022-07-25T17:52:35Z

util/rbac/rbac.go

+// newAdditionalInformer returns an informer which watches updates on the rbac configmap
+func (e *Enforcer) newAdditionalInformer() cache.SharedIndexInformer {
+	tweakConfigMap := func(options *metav1.ListOptions) {
+		options.LabelSelector = "argocd.argoproj.io/cm-type=additional-rbac"


Should additional-rbac become a constant?

And also, I'm in favor for dropping additional and just having it named rbac

v1ctorrhs · 2022-08-25T12:32:51Z

@notfromstatefarm when is this expected to be merged? Thanks

v1ctorrhs · 2022-09-09T07:50:49Z

@notfromstatefarm sorry to ping again, what's needed here?

crenshaw-dev · 2022-09-09T11:03:26Z

@v1ctorrhs Jann's comments need to be addressed before this can be merged. I think @notfromstatefarm has been too busy to work on this PR. Do you think you'd be able to pick it up and finish off the last few items?

m0un10 · 2022-09-27T09:45:18Z

This PR is just what we are looking for! 😍😍😍😍
If released, we'd be able to remove 100s of lines from our kustomize overlays.
This is because we'd be able to have a base argocd-rbac-cm and then smaller ones for each overlay.
Is it being blocked because it needs a constant and a name change? If so, let me know and I can raise a PR against this PR with the fix.

crenshaw-dev · 2022-10-09T01:52:47Z

@notfromstatefarm want to close this for now until you (or someone else) has time to pick it back up?

bilalcaliskan · 2022-10-31T23:52:06Z

greetings everyone, i am willing to pick the PR from the current state and try to complete requirements if that's ok for @notfromstatefarm. i will start working on your fork btw.

crenshaw-dev · 2022-11-01T02:49:16Z

@bilalcaliskan sounds great! Let me know if you need any help.

bilalcaliskan · 2022-11-21T23:25:43Z

by the way i am currently working on that PR on https://github.com/bilalcaliskan/argo-cd/tree/feat/additional-rbac-configmaps which is my own fork from argoproj/argo-cd since i dont have push permission on the branch of that repository. Just a single code review recommendation left (#9976 (comment))

@crenshaw-dev Is it OK to implement that feature on different PR by marking notfromstatefarm and myself as co-authors? I am having trouble to decide how to proceed with that feature since we cant access to notfromstatefarm, so just wondering your opinion.

leoluz · 2023-02-17T16:28:05Z

We are facing a similar issue at Intuit and we require something similar. However I don't understand the reason of adding an additional configmap for that. I implemented a similar feature in a different PR using additional predefined keys in the same configmap.

Please take a look: #12511

The advantages of that approach are:

doesn't require users to provide additional configmaps.
backwards compatible
easy to integrate with kustomize overlays
simpler implementation

The cons are:

can not handle RBAC csv's bigger than 1MiB which is the current limit of configmap
requires config management setup (kustomize, helm, etc). Doesn't work with "JBOCM" concept(Just a bunch of ConfigMaps)

wdyt @jessesuen @jannfis @notfromstatefarm @crenshaw-dev

jannfis · 2023-02-17T19:41:55Z

I like that approach, @leoluz. It's simple enough to be useful for me.

As a con, I'd like to add: Requires some kind of config management tool such as Kustomize to leverage, as opposed to the "JBOCM" (Just a bunch of ConfigMaps) approach of the original PR.

jannfis · 2023-02-17T19:44:16Z

@leoluz Oh. And another one would maybe the etcd size limit for resources (thinking in terms of really huge amounts of RBAC rules to fit into a single ConfigMap resource).

leoluz · 2023-02-17T20:00:53Z

@jannfis Thank you! Updated my previous message with both cons.

btw.. Is JBOCM a thing? :D

JorTurFer · 2023-03-22T11:18:04Z

Hello,
Any update about this? This feature would be nice for our use case

feat: additional RBAC configmaps

826f031

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

notfromstatefarm force-pushed the feat/additional-rbac-configmaps branch from 0c7a474 to 826f031 Compare July 13, 2022 17:36

add basic docs

eb97180

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

notfromstatefarm mentioned this pull request Jul 13, 2022

Multiple rbac configmap support #9972

Closed

notfromstatefarm added 2 commits July 13, 2022 14:10

add test

281225d

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

add security levels

577dea2

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

notfromstatefarm force-pushed the feat/additional-rbac-configmaps branch from e7413cc to 577dea2 Compare July 13, 2022 18:59

use more standard label argocd.argoproj.io/cm-type

17876a8

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

notfromstatefarm force-pushed the feat/additional-rbac-configmaps branch from ba05ebb to 17876a8 Compare July 14, 2022 18:59

crenshaw-dev requested changes Jul 15, 2022

View reviewed changes

ashutosh16 reviewed Jul 15, 2022

View reviewed changes

docs/operator-manual/rbac.md Show resolved Hide resolved

fix comment/docs

8ede094

Signed-off-by: notfromstatefarm <86763948+notfromstatefarm@users.noreply.github.com>

jannfis reviewed Jul 25, 2022

View reviewed changes

notfromstatefarm mentioned this pull request Aug 9, 2022

REQUEST: New membership for notfromstatefarm argoproj/argoproj#147

Closed

5 tasks

crenshaw-dev mentioned this pull request Oct 14, 2022

support for multiple rbac configmaps #8324

Open

bilalcaliskan mentioned this pull request Nov 27, 2022

feat: ability to add additional configmaps #11445

Closed

10 tasks

bilalcaliskan mentioned this pull request Sep 2, 2023

[Draft] feat: multiple policy configmap support enabled #15325

Closed

10 tasks

todaywasawesome added the lifecycle/rotten Issue/PR had no activity for a long time and should be closed soon label Feb 15, 2024

meln5674 mentioned this pull request Apr 13, 2024

feat: Support for multiple rbac ConfigMaps (Alpha) #17828

Open

14 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: additional RBAC configmaps #9976

feat: additional RBAC configmaps #9976

notfromstatefarm commented Jul 13, 2022 •

edited by crenshaw-dev

codecov bot commented Jul 13, 2022 •

edited

crenshaw-dev Jul 15, 2022

bilalcaliskan Nov 21, 2022

jessesuen commented Jul 25, 2022

jannfis commented Jul 25, 2022

jannfis commented Jul 25, 2022

jannfis Jul 25, 2022

v1ctorrhs commented Aug 25, 2022

v1ctorrhs commented Sep 9, 2022

crenshaw-dev commented Sep 9, 2022

m0un10 commented Sep 27, 2022

crenshaw-dev commented Oct 9, 2022

bilalcaliskan commented Oct 31, 2022

crenshaw-dev commented Nov 1, 2022

bilalcaliskan commented Nov 21, 2022 •

edited

leoluz commented Feb 17, 2023 •

edited

jannfis commented Feb 17, 2023

jannfis commented Feb 17, 2023

leoluz commented Feb 17, 2023

JorTurFer commented Mar 22, 2023

feat: additional RBAC configmaps #9976

Are you sure you want to change the base?

feat: additional RBAC configmaps #9976

Conversation

notfromstatefarm commented Jul 13, 2022 • edited by crenshaw-dev

codecov bot commented Jul 13, 2022 • edited

Codecov Report

crenshaw-dev Jul 15, 2022

Choose a reason for hiding this comment

bilalcaliskan Nov 21, 2022

Choose a reason for hiding this comment

jessesuen commented Jul 25, 2022

jannfis commented Jul 25, 2022

jannfis commented Jul 25, 2022

jannfis Jul 25, 2022

Choose a reason for hiding this comment

v1ctorrhs commented Aug 25, 2022

v1ctorrhs commented Sep 9, 2022

crenshaw-dev commented Sep 9, 2022

m0un10 commented Sep 27, 2022

crenshaw-dev commented Oct 9, 2022

bilalcaliskan commented Oct 31, 2022

crenshaw-dev commented Nov 1, 2022

bilalcaliskan commented Nov 21, 2022 • edited

leoluz commented Feb 17, 2023 • edited

jannfis commented Feb 17, 2023

jannfis commented Feb 17, 2023

leoluz commented Feb 17, 2023

JorTurFer commented Mar 22, 2023

notfromstatefarm commented Jul 13, 2022 •

edited by crenshaw-dev

codecov bot commented Jul 13, 2022 •

edited

bilalcaliskan commented Nov 21, 2022 •

edited

leoluz commented Feb 17, 2023 •

edited