Allow configuring/toggling/removing of full_control_namespace role binding

Aperta
  • Qualcosa non va?
#551 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
java, kubernetes
Ambito
authorization, backend

Direzione di ricerca

Inizia da onyxia-api/src/main/java/fr/insee/onyxia/api/services/impl/kubernetes/KubernetesService.java alle righe 120-138, dove vengono referenziati il RoleBinding full_control_namespace e il ClusterRole admin hardcoded. Segui l’endpoint di onboarding e determina se il risultato richiesto è un toggle, un ClusterRole configurabile o una rimozione, quindi verifica che l’onboarding non fallisca più quando Kubernetes aggiunge CRD con autorizzazioni RBAC aggregate.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Hello,

Currently, Onyxia creates the full_control_namespace RoleBinding in every namespaces it creates, using the hardcoded admin ClusterRole :

https://github.com/InseeFrLab/onyxia-api/blob/2b4e652ade8cbe12a8735ef76f5c73ed2a3e5aac/onyxia-api/src/main/java/fr/insee/onyxia/api/services/impl/kubernetes/KubernetesService.java#L120-L138

This behavior is not always desirable, and when it is, the aggregated ClusterRole admin can be more permissive than necessary. Is it possible to mitigate this, for instance by :

  • adding a flag to toggle the creation of the full_control_namespace RoleBinding by Onyxia
  • allowing to change the ClusterRole referenced in full_control_namespace
  • removing this entirely, if it is no longer useful for anyone

Thanks !

EDIT : I realize I didn't even mention the main issue at hand. The hardcoded reference to the admin ClusterRole has a direct impact on Onyxia configuration. Whenever the Kubernetes cluster running Onyxia adds a new operator (or otherwise "registers" any new CRD on the aggregated view/edit/admin ClusterRoles), the relevant RBAC permissions must be added to a ClusterRole binded to the ServiceAccount running onyxia-api. Failing to do so triggers errors on the onboarding endpoint, when it tries to patch the full_control_namespace RoleBinding, which in turns makes onyxia-web unusable (alert with 500 error on the homepage).

For instance, after installing External Secrets Operator in our cluster, we could see the following in onyxia-api's logs :

2025-01-29T09:03:51.484Z ERROR 27 --- [nio-8080-exec-3] o.a.c.c.C.[.[.[.[dispatcherServlet]      : Servlet.service() for servlet [dispatcherServlet] in context with path [/api] threw exception [Request processing failed: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: POST at: https://redacted:443/apis/rbac.authorization.k8s.io/v1/namespaces/redacted/rolebindings. Message: rolebindings.rbac.authorization.k8s.io "full_control_namespace" is forbidden: user "system:serviceaccount:onyxia:onyxia-api" (groups=["system:serviceaccounts" "system:serviceaccounts:onyxia" "system:authenticated"]) is attempting to grant RBAC permissions not currently held:
{APIGroups:["external-secrets.io"], Resources:["clustersecretstores"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["external-secrets.io"], Resources:["externalsecrets"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["external-secrets.io"], Resources:["pushsecrets"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["external-secrets.io"], Resources:["secretstores"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["acraccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["clustergenerators"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["ecrauthorizationtokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["fakes"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["gcraccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["githubaccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["passwords"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["quayaccesstokens"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["vaultdynamicsecrets"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}
{APIGroups:["generators.external-secrets.io"], Resources:["webhooks"], Verbs:["create" "delete" "deletecollection" "patch" "update" "get" "watch" "list"]}.
Lingua principale
Java
Stelle
34
Fork
34
Merge medio
9m
PR unite (30g)
4

Preparare l'ambiente

Questo progetto non fornisce container di sviluppo, Dockerfile né guida per i contributori, quindi l'ambiente è a tuo carico: parti dal suo README e consulta la nostra guida al primo contributo per i passaggi generali.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di InseeFrLab/onyxia-api

Tutte le issue di InseeFrLab/onyxia-api

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.