Allow configuring/toggling/removing of full_control_namespace role binding

Abierto
  • ¿Algo no está bien?
#551 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Nueva funcionalidad
Claridad
Bastante claro
Estado de actividad
Estancado
Stack tecnológico
java, kubernetes
Área
authorization, backend

Línea de trabajo

Empieza en onyxia-api/src/main/java/fr/insee/onyxia/api/services/impl/kubernetes/KubernetesService.java, en las líneas 120-138, donde se hace referencia al RoleBinding full_control_namespace y al ClusterRole admin codificado de forma fija. Sigue el endpoint de onboarding y determina si el resultado solicitado es un interruptor, un ClusterRole configurable o una eliminación; después, verifica que el onboarding ya no falle cuando Kubernetes añade CRDs con permisos RBAC agregados.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Hello,

Currently, Onyxia creates the full_control_namespace RoleBinding in every namespaces it creates, using the hardcoded admin ClusterRole :

https://github.com/InseeFrLab/onyxia-api/blob/2b4e652ade8cbe12a8735ef76f5c73ed2a3e5aac/onyxia-api/src/main/java/fr/insee/onyxia/api/services/impl/kubernetes/KubernetesService.java#L120-L138

This behavior is not always desirable, and when it is, the aggregated ClusterRole admin can be more permissive than necessary. Is it possible to mitigate this, for instance by :

  • adding a flag to toggle the creation of the full_control_namespace RoleBinding by Onyxia
  • allowing to change the ClusterRole referenced in full_control_namespace
  • removing this entirely, if it is no longer useful for anyone

Thanks !

EDIT : I realize I didn't even mention the main issue at hand. The hardcoded reference to the admin ClusterRole has a direct impact on Onyxia configuration. Whenever the Kubernetes cluster running Onyxia adds a new operator (or otherwise "registers" any new CRD on the aggregated view/edit/admin ClusterRoles), the relevant RBAC permissions must be added to a ClusterRole binded to the ServiceAccount running onyxia-api. Failing to do so triggers errors on the onboarding endpoint, when it tries to patch the full_control_namespace RoleBinding, which in turns makes onyxia-web unusable (alert with 500 error on the homepage).

For instance, after installing External Secrets Operator in our cluster, we could see the following in onyxia-api's logs :

2025-01-29T09:03:51.484Z ERROR 27 --- [nio-8080-exec-3] o.a.c.c.C.[.[.[.[dispatcherServlet]      : Servlet.service() for servlet [dispatcherServlet] in context with path [/api] threw exception [Request processing failed: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://redacted:443/apis/rbac.authorization.k8s.io/v1/namespaces/redacted/rolebindings. Message: rolebindings.rbac.authorization.k8s.io "full_control_namespace" is forbidden: user "system:serviceaccount:onyxia:onyxia-api" (groups=["system:serviceaccounts" "system:serviceaccounts:onyxia" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:["external-secrets.io"], Resources:["clustersecretstores"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["external-secrets.io"], Resources:["externalsecrets"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["external-secrets.io"], Resources:["pushsecrets"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["external-secrets.io"], Resources:["secretstores"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["acraccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["clustergenerators"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["ecrauthorizationtokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["fakes"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["gcraccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["githubaccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["passwords"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["quayaccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["vaultdynamicsecrets"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["webhooks"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}.
Lenguaje dominante
Java
Estrellas
34
Forks
34
Merge medio
1 d 5 h
PR fusionados (30 d)
15

Preparar el entorno

Este proyecto no incluye contenedor de desarrollo, Dockerfile ni guía de contribución, así que la configuración corre por tu cuenta: empieza por su README y consulta nuestra guía para la primera contribución para los pasos generales.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de InseeFrLab/onyxia-api

Todos los issues de InseeFrLab/onyxia-api

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.