mirror of https://github.com/hashicorp/consul
aahel
12 months ago
committed by
GitHub
21 changed files with 611 additions and 142 deletions
@ -0,0 +1,90 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package types |
||||
|
||||
import ( |
||||
"github.com/hashicorp/go-multierror" |
||||
|
||||
"github.com/hashicorp/consul/acl" |
||||
"github.com/hashicorp/consul/internal/resource" |
||||
pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v2beta1" |
||||
"github.com/hashicorp/consul/proto-public/pbresource" |
||||
) |
||||
|
||||
type DecodedNodeHealthStatus = resource.DecodedResource[*pbcatalog.NodeHealthStatus] |
||||
|
||||
func RegisterNodeHealthStatus(r resource.Registry) { |
||||
r.Register(resource.Registration{ |
||||
Type: pbcatalog.NodeHealthStatusType, |
||||
Proto: &pbcatalog.NodeHealthStatus{}, |
||||
Scope: resource.ScopePartition, |
||||
Validate: ValidateNodeHealthStatus, |
||||
ACLs: &resource.ACLHooks{ |
||||
Read: resource.AuthorizeReadWithResource(aclReadHookNodeHealthStatus), |
||||
Write: aclWriteHookNodeHealthStatus, |
||||
List: resource.NoOpACLListHook, |
||||
}, |
||||
}) |
||||
} |
||||
|
||||
var ValidateNodeHealthStatus = resource.DecodeAndValidate(validateNodeHealthStatus) |
||||
|
||||
func validateNodeHealthStatus(res *DecodedNodeHealthStatus) error { |
||||
var err error |
||||
|
||||
// Should we allow empty types? I think for now it will be safest to require
|
||||
// the type field is set and we can relax this restriction in the future
|
||||
// if we deem it desirable.
|
||||
if res.Data.Type == "" { |
||||
err = multierror.Append(err, resource.ErrInvalidField{ |
||||
Name: "type", |
||||
Wrapped: resource.ErrMissing, |
||||
}) |
||||
} |
||||
|
||||
switch res.Data.Status { |
||||
case pbcatalog.Health_HEALTH_PASSING, |
||||
pbcatalog.Health_HEALTH_WARNING, |
||||
pbcatalog.Health_HEALTH_CRITICAL, |
||||
pbcatalog.Health_HEALTH_MAINTENANCE: |
||||
default: |
||||
err = multierror.Append(err, resource.ErrInvalidField{ |
||||
Name: "status", |
||||
Wrapped: errInvalidHealth, |
||||
}) |
||||
} |
||||
|
||||
// Ensure that the NodeHealthStatus' owner is a type that we want to allow. The
|
||||
// owner is currently the resource that this NodeHealthStatus applies to. If we
|
||||
// change this to be a parent reference within the NodeHealthStatus.Data then
|
||||
// we could allow for other owners.
|
||||
if res.Resource.Owner == nil { |
||||
err = multierror.Append(err, resource.ErrInvalidField{ |
||||
Name: "owner", |
||||
Wrapped: resource.ErrMissing, |
||||
}) |
||||
} else if !resource.EqualType(res.Owner.Type, pbcatalog.NodeType) { |
||||
err = multierror.Append(err, resource.ErrOwnerTypeInvalid{ResourceType: res.Id.Type, OwnerType: res.Owner.Type}) |
||||
} |
||||
|
||||
return err |
||||
} |
||||
|
||||
func aclReadHookNodeHealthStatus(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext, res *pbresource.Resource) error { |
||||
// For a health status of a node we need to check node:read perms.
|
||||
if res.GetOwner() != nil && resource.EqualType(res.GetOwner().GetType(), pbcatalog.NodeType) { |
||||
return authorizer.ToAllowAuthorizer().NodeReadAllowed(res.GetOwner().GetName(), authzContext) |
||||
} |
||||
|
||||
return acl.PermissionDenied("cannot read catalog.NodeHealthStatus because there is no owner") |
||||
} |
||||
|
||||
func aclWriteHookNodeHealthStatus(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext, res *pbresource.Resource) error { |
||||
// For a health status of a node we need to check node:write perms.
|
||||
if res.GetOwner() != nil && resource.EqualType(res.GetOwner().GetType(), pbcatalog.NodeType) { |
||||
return authorizer.ToAllowAuthorizer().NodeWriteAllowed(res.GetOwner().GetName(), authzContext) |
||||
} |
||||
|
||||
return acl.PermissionDenied("cannot write catalog.NodeHealthStatus because there is no owner") |
||||
} |
||||
@ -0,0 +1,273 @@
|
||||
// Copyright (c) HashiCorp, Inc.
|
||||
// SPDX-License-Identifier: BUSL-1.1
|
||||
|
||||
package types |
||||
|
||||
import ( |
||||
"testing" |
||||
|
||||
"github.com/hashicorp/consul/internal/resource" |
||||
"github.com/hashicorp/consul/internal/resource/resourcetest" |
||||
pbcatalog "github.com/hashicorp/consul/proto-public/pbcatalog/v2beta1" |
||||
"github.com/hashicorp/consul/proto-public/pbresource" |
||||
"github.com/stretchr/testify/require" |
||||
"google.golang.org/protobuf/reflect/protoreflect" |
||||
"google.golang.org/protobuf/types/known/anypb" |
||||
) |
||||
|
||||
var ( |
||||
defaultNodeHealthStatusOwnerTenancy = &pbresource.Tenancy{ |
||||
Partition: "default", |
||||
PeerName: "local", |
||||
} |
||||
|
||||
defaultNodeHealthStatusOwner = &pbresource.ID{ |
||||
Type: pbcatalog.NodeType, |
||||
Tenancy: defaultNodeHealthStatusOwnerTenancy, |
||||
Name: "foo", |
||||
} |
||||
) |
||||
|
||||
func createNodeHealthStatusResource(t *testing.T, data protoreflect.ProtoMessage, owner *pbresource.ID) *pbresource.Resource { |
||||
res := &pbresource.Resource{ |
||||
Id: &pbresource.ID{ |
||||
Type: pbcatalog.NodeHealthStatusType, |
||||
Tenancy: &pbresource.Tenancy{ |
||||
Partition: "default", |
||||
PeerName: "local", |
||||
}, |
||||
Name: "test-status", |
||||
}, |
||||
Owner: owner, |
||||
} |
||||
|
||||
var err error |
||||
res.Data, err = anypb.New(data) |
||||
require.NoError(t, err) |
||||
return res |
||||
} |
||||
|
||||
func TestValidateNodeHealthStatus_Ok(t *testing.T) { |
||||
data := &pbcatalog.NodeHealthStatus{ |
||||
Type: "tcp", |
||||
Status: pbcatalog.Health_HEALTH_PASSING, |
||||
Description: "Doesn't matter as this is user settable", |
||||
Output: "Health check executors are free to use this field", |
||||
} |
||||
|
||||
type testCase struct { |
||||
owner *pbresource.ID |
||||
} |
||||
|
||||
cases := map[string]testCase{ |
||||
"node-owned": { |
||||
owner: &pbresource.ID{ |
||||
Type: pbcatalog.NodeType, |
||||
Tenancy: defaultNodeHealthStatusOwnerTenancy, |
||||
Name: "bar-node", |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
for name, tcase := range cases { |
||||
t.Run(name, func(t *testing.T) { |
||||
res := createNodeHealthStatusResource(t, data, tcase.owner) |
||||
err := ValidateNodeHealthStatus(res) |
||||
require.NoError(t, err) |
||||
}) |
||||
} |
||||
} |
||||
|
||||
func TestValidateNodeHealthStatus_ParseError(t *testing.T) { |
||||
// Any type other than the NodeHealthStatus type would work
|
||||
// to cause the error we are expecting
|
||||
data := &pbcatalog.IP{Address: "198.18.0.1"} |
||||
|
||||
res := createNodeHealthStatusResource(t, data, defaultNodeHealthStatusOwner) |
||||
|
||||
err := ValidateNodeHealthStatus(res) |
||||
require.Error(t, err) |
||||
require.ErrorAs(t, err, &resource.ErrDataParse{}) |
||||
} |
||||
|
||||
func TestValidateNodeHealthStatus_InvalidHealth(t *testing.T) { |
||||
// while this is a valid enum value it is not allowed to be used
|
||||
// as the Status field.
|
||||
data := &pbcatalog.NodeHealthStatus{ |
||||
Type: "tcp", |
||||
Status: pbcatalog.Health_HEALTH_ANY, |
||||
} |
||||
|
||||
res := createNodeHealthStatusResource(t, data, defaultNodeHealthStatusOwner) |
||||
|
||||
err := ValidateNodeHealthStatus(res) |
||||
require.Error(t, err) |
||||
expected := resource.ErrInvalidField{ |
||||
Name: "status", |
||||
Wrapped: errInvalidHealth, |
||||
} |
||||
var actual resource.ErrInvalidField |
||||
require.ErrorAs(t, err, &actual) |
||||
require.Equal(t, expected, actual) |
||||
} |
||||
|
||||
func TestValidateNodeHealthStatus_MissingType(t *testing.T) { |
||||
data := &pbcatalog.NodeHealthStatus{ |
||||
Status: pbcatalog.Health_HEALTH_PASSING, |
||||
} |
||||
|
||||
res := createNodeHealthStatusResource(t, data, defaultNodeHealthStatusOwner) |
||||
|
||||
err := ValidateNodeHealthStatus(res) |
||||
require.Error(t, err) |
||||
expected := resource.ErrInvalidField{ |
||||
Name: "type", |
||||
Wrapped: resource.ErrMissing, |
||||
} |
||||
var actual resource.ErrInvalidField |
||||
require.ErrorAs(t, err, &actual) |
||||
require.Equal(t, expected, actual) |
||||
} |
||||
|
||||
func TestValidateNodeHealthStatus_MissingOwner(t *testing.T) { |
||||
data := &pbcatalog.NodeHealthStatus{ |
||||
Type: "tcp", |
||||
Status: pbcatalog.Health_HEALTH_PASSING, |
||||
} |
||||
|
||||
res := createNodeHealthStatusResource(t, data, nil) |
||||
|
||||
err := ValidateNodeHealthStatus(res) |
||||
require.Error(t, err) |
||||
expected := resource.ErrInvalidField{ |
||||
Name: "owner", |
||||
Wrapped: resource.ErrMissing, |
||||
} |
||||
var actual resource.ErrInvalidField |
||||
require.ErrorAs(t, err, &actual) |
||||
require.Equal(t, expected, actual) |
||||
} |
||||
|
||||
func TestValidateNodeHealthStatus_InvalidOwner(t *testing.T) { |
||||
data := &pbcatalog.NodeHealthStatus{ |
||||
Type: "tcp", |
||||
Status: pbcatalog.Health_HEALTH_PASSING, |
||||
} |
||||
|
||||
type testCase struct { |
||||
owner *pbresource.ID |
||||
} |
||||
|
||||
cases := map[string]testCase{ |
||||
"group-mismatch": { |
||||
owner: &pbresource.ID{ |
||||
Type: &pbresource.Type{ |
||||
Group: "fake", |
||||
GroupVersion: pbcatalog.Version, |
||||
Kind: pbcatalog.NodeKind, |
||||
}, |
||||
Tenancy: defaultNodeHealthStatusOwnerTenancy, |
||||
Name: "baz", |
||||
}, |
||||
}, |
||||
"group-version-mismatch": { |
||||
owner: &pbresource.ID{ |
||||
Type: &pbresource.Type{ |
||||
Group: pbcatalog.GroupName, |
||||
GroupVersion: "v99", |
||||
Kind: pbcatalog.NodeKind, |
||||
}, |
||||
Tenancy: defaultNodeHealthStatusOwnerTenancy, |
||||
Name: "baz", |
||||
}, |
||||
}, |
||||
"kind-mismatch": { |
||||
owner: &pbresource.ID{ |
||||
Type: pbcatalog.ServiceType, |
||||
Tenancy: defaultNodeHealthStatusOwnerTenancy, |
||||
Name: "baz", |
||||
}, |
||||
}, |
||||
} |
||||
|
||||
for name, tcase := range cases { |
||||
t.Run(name, func(t *testing.T) { |
||||
res := createNodeHealthStatusResource(t, data, tcase.owner) |
||||
err := ValidateNodeHealthStatus(res) |
||||
require.Error(t, err) |
||||
expected := resource.ErrOwnerTypeInvalid{ |
||||
ResourceType: pbcatalog.NodeHealthStatusType, |
||||
OwnerType: tcase.owner.Type, |
||||
} |
||||
var actual resource.ErrOwnerTypeInvalid |
||||
require.ErrorAs(t, err, &actual) |
||||
require.Equal(t, expected, actual) |
||||
}) |
||||
} |
||||
} |
||||
|
||||
func TestNodeHealthStatusACLs(t *testing.T) { |
||||
registry := resource.NewRegistry() |
||||
Register(registry) |
||||
|
||||
node := resourcetest.Resource(pbcatalog.NodeType, "test").ID() |
||||
|
||||
nodehealthStatusData := &pbcatalog.NodeHealthStatus{ |
||||
Type: "tcp", |
||||
Status: pbcatalog.Health_HEALTH_PASSING, |
||||
} |
||||
|
||||
cases := map[string]resourcetest.ACLTestCase{ |
||||
"no rules": { |
||||
Rules: ``, |
||||
Data: nodehealthStatusData, |
||||
Owner: node, |
||||
Typ: pbcatalog.NodeHealthStatusType, |
||||
ReadOK: resourcetest.DENY, |
||||
WriteOK: resourcetest.DENY, |
||||
ListOK: resourcetest.DEFAULT, |
||||
}, |
||||
"service test read with node owner": { |
||||
Rules: `service "test" { policy = "read" }`, |
||||
Data: nodehealthStatusData, |
||||
Owner: node, |
||||
Typ: pbcatalog.NodeHealthStatusType, |
||||
ReadOK: resourcetest.DENY, |
||||
WriteOK: resourcetest.DENY, |
||||
ListOK: resourcetest.DEFAULT, |
||||
}, |
||||
"service test write with node owner": { |
||||
Rules: `service "test" { policy = "write" }`, |
||||
Data: nodehealthStatusData, |
||||
Owner: node, |
||||
Typ: pbcatalog.NodeHealthStatusType, |
||||
ReadOK: resourcetest.DENY, |
||||
WriteOK: resourcetest.DENY, |
||||
ListOK: resourcetest.DEFAULT, |
||||
}, |
||||
"node test read with node owner": { |
||||
Rules: `node "test" { policy = "read" }`, |
||||
Data: nodehealthStatusData, |
||||
Owner: node, |
||||
Typ: pbcatalog.NodeHealthStatusType, |
||||
ReadOK: resourcetest.ALLOW, |
||||
WriteOK: resourcetest.DENY, |
||||
ListOK: resourcetest.DEFAULT, |
||||
}, |
||||
"node test write with node owner": { |
||||
Rules: `node "test" { policy = "write" }`, |
||||
Data: nodehealthStatusData, |
||||
Owner: node, |
||||
Typ: pbcatalog.NodeHealthStatusType, |
||||
ReadOK: resourcetest.ALLOW, |
||||
WriteOK: resourcetest.ALLOW, |
||||
ListOK: resourcetest.DEFAULT, |
||||
}, |
||||
} |
||||
|
||||
for name, tc := range cases { |
||||
t.Run(name, func(t *testing.T) { |
||||
resourcetest.RunACLTestCase(t, tc, registry) |
||||
}) |
||||
} |
||||
} |
||||
Loading…
Reference in new issue