github
/
consul
mirror of https://github.com/hashicorp/consul
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Add BoundReferences to ComputedTrafficPermissions (#20593)

Browse Source
pull/20622/head
Chris S. Kim 10 months ago committed by GitHub
parent 0f0b080514
commit ab3c6cf1e5
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
6 changed files with 240 additions and 79 deletions
Show Stats Download Patch File Download Diff File

10
internal/auth/internal/controllers/trafficpermissions/builder.go
Unescape View File

@ -21,6 +21,7 @@ type trafficPermissionsBuilder struct {
denyPermissions []*pbauth.Permission
sgExpander expander.SamenessGroupExpander
sgMap map[string][]*pbmulticluster.SamenessGroupMember
brc *resource.BoundReferenceCollector
}
type missingSamenessGroupReferences struct {
@ -28,7 +29,10 @@ type missingSamenessGroupReferences struct {
samenessGroups []string
}
func newTrafficPermissionsBuilder(expander expander.SamenessGroupExpander, sgMap map[string][]*pbmulticluster.SamenessGroupMember) *trafficPermissionsBuilder {
func newTrafficPermissionsBuilder(
expander expander.SamenessGroupExpander,
sgMap map[string][]*pbmulticluster.SamenessGroupMember,
brc *resource.BoundReferenceCollector) *trafficPermissionsBuilder {
return &trafficPermissionsBuilder{
sgMap: sgMap,
missing: make(map[resource.ReferenceKey]missingSamenessGroupReferences),
@ -36,11 +40,14 @@ func newTrafficPermissionsBuilder(expander expander.SamenessGroupExpander, sgMap
sgExpander: expander,
allowedPermissions: make([]*pbauth.Permission, 0),
denyPermissions: make([]*pbauth.Permission, 0),
brc: brc,
}
}
// track will use all associated XTrafficPermissions to create new ComputedTrafficPermissions samenessGroupsForTrafficPermission
func track[S types.XTrafficPermissions](tpb *trafficPermissionsBuilder, xtp *resource.DecodedResource[S]) {
tpb.brc.AddRefOrID(xtp.Id)
permissions, missingSamenessGroups := tpb.sgExpander.Expand(xtp.Data, tpb.sgMap)
if len(missingSamenessGroups) > 0 {
@ -64,6 +71,7 @@ func (tpb *trafficPermissionsBuilder) build() (*pbauth.ComputedTrafficPermission
AllowPermissions: tpb.allowedPermissions,
DenyPermissions: tpb.denyPermissions,
IsDefault: tpb.isDefault,
BoundReferences: tpb.brc.List(),
}, tpb.missing
}

62
internal/auth/internal/controllers/trafficpermissions/controller.go
Unescape View File

@ -10,21 +10,15 @@ import (
"google.golang.org/protobuf/types/known/anypb"
"github.com/hashicorp/consul/internal/auth/internal/controllers/trafficpermissions/expander"
"github.com/hashicorp/consul/internal/auth/internal/types"
"github.com/hashicorp/consul/internal/controller"
"github.com/hashicorp/consul/internal/controller/cache"
"github.com/hashicorp/consul/internal/controller/cache/index"
"github.com/hashicorp/consul/internal/controller/cache/indexers"
"github.com/hashicorp/consul/internal/controller/dependency"
"github.com/hashicorp/consul/internal/resource"
pbauth "github.com/hashicorp/consul/proto-public/pbauth/v2beta1"
"github.com/hashicorp/consul/proto-public/pbresource"
)
const (
TenancyIndexName = "tenancy"
)
// TrafficPermissionsMapper is used to map a watch event for a TrafficPermissions resource and translate
// it to a ComputedTrafficPermissions resource which contains the effective permissions
// from all referencing TrafficPermissions resources.
@ -52,6 +46,8 @@ func Controller(mapper TrafficPermissionsMapper, sgExpander expander.SamenessGro
samenessGroupIndex := GetSamenessGroupIndex()
boundRefsMapper := dependency.CacheListMapper(pbauth.ComputedTrafficPermissionsType, BoundRefsIndexName)
// Maps incoming PartitionTrafficPermissions to ComputedTrafficPermissions requests by prefix searching
// the CTP's tenancy.
ptpToCtpMapper := func(ctx context.Context, rt controller.Runtime, res *pbresource.Resource) ([]controller.Request, error) {
@ -91,29 +87,20 @@ func Controller(mapper TrafficPermissionsMapper, sgExpander expander.SamenessGro
return reqs, nil
}
ctrl := controller.NewController(StatusKey, pbauth.ComputedTrafficPermissionsType).
WithWatch(pbauth.WorkloadIdentityType, dependency.ReplaceType(pbauth.ComputedTrafficPermissionsType)).
WithWatch(pbauth.TrafficPermissionsType, mapper.MapTrafficPermissions, samenessGroupIndex).
WithWatch(pbauth.PartitionTrafficPermissionsType, ptpToCtpMapper,
indexers.DecodedSingleIndexer(
TenancyIndexName,
index.SingleValueFromArgs(func(t *pbresource.Tenancy) ([]byte, error) {
return index.IndexFromTenancy(t), nil
}),
func(r *types.DecodedPartitionTrafficPermissions) (bool, []byte, error) {
return true, index.IndexFromTenancy(r.Id.Tenancy), nil
},
)).
WithWatch(pbauth.NamespaceTrafficPermissionsType, ntpToCtpMapper,
indexers.DecodedSingleIndexer(
TenancyIndexName,
index.SingleValueFromArgs(func(t *pbresource.Tenancy) ([]byte, error) {
return index.IndexFromTenancy(t), nil
}),
func(r *types.DecodedNamespaceTrafficPermissions) (bool, []byte, error) {
return true, index.IndexFromTenancy(r.Id.Tenancy), nil
},
)).
ctrl := controller.NewController(StatusKey,
pbauth.ComputedTrafficPermissionsType,
boundRefsIndex).
WithWatch(pbauth.WorkloadIdentityType,
dependency.ReplaceType(pbauth.ComputedTrafficPermissionsType)).
WithWatch(pbauth.TrafficPermissionsType,
dependency.MultiMapper(boundRefsMapper, mapper.MapTrafficPermissions),
samenessGroupIndex).
WithWatch(pbauth.PartitionTrafficPermissionsType,
dependency.MultiMapper(boundRefsMapper, ptpToCtpMapper),
indexPtpByTenancy()).
WithWatch(pbauth.NamespaceTrafficPermissionsType,
dependency.MultiMapper(boundRefsMapper, ntpToCtpMapper),
indexNtpByTenancy()).
WithReconciler(&reconciler{mapper: mapper, sgExpander: sgExpander})
return registerEnterpriseControllerWatchers(ctrl)
@ -124,11 +111,23 @@ type reconciler struct {
sgExpander expander.SamenessGroupExpander
}
// Reconcile will reconcile one ComputedTrafficPermission (CTP) in response to some event.
// Reconcile will reconcile one ComputedTrafficPermissions (CTP) in response to some event.
// Events include adding, modifying or deleting a WorkloadIdentity or TrafficPermission or SamenessGroupType.
func (r *reconciler) Reconcile(ctx context.Context, rt controller.Runtime, req controller.Request) error {
rt.Logger = rt.Logger.With("resource-id", req.ID, "controller", StatusKey)
// The bound reference collector is supposed to aggregate all
// references to resources that influence the production of
// a ComputedTrafficPermissions resource.
//
// We only add a reference to the collector if the following are ALL true:
//
// - We load the resource for some reason.
// - The resource is found.
// - We decided to use the information in that resource to produce
// ComputedTrafficPermissions.
brc := resource.NewBoundReferenceCollector()
ctpID := req.ID
oldCTPData, err := resource.GetDecodedResource[*pbauth.ComputedTrafficPermissions](ctx, rt.Client, ctpID)
if err != nil {
@ -171,13 +170,12 @@ func (r *reconciler) Reconcile(ctx context.Context, rt controller.Runtime, req c
}
sgMap, err := r.sgExpander.List(ctx, rt, req)
if err != nil {
rt.Logger.Error("error retrieving sameness groups", err.Error())
return err
}
trafficPermissionBuilder := newTrafficPermissionsBuilder(r.sgExpander, sgMap)
trafficPermissionBuilder := newTrafficPermissionsBuilder(r.sgExpander, sgMap, brc)
var tpResources []*pbresource.Resource
// Part 2: Recompute a CTP from TP create / modify / delete, or create a new CTP from existing TPs:

98
internal/auth/internal/controllers/trafficpermissions/controller_test.go
Unescape View File

@ -11,11 +11,11 @@ import (
"github.com/stretchr/testify/require"
"github.com/stretchr/testify/suite"
svctest "github.com/hashicorp/consul/agent/grpc-external/services/resource/testing"
"github.com/hashicorp/consul/internal/auth/internal/controllers/trafficpermissions/expander"
"github.com/hashicorp/consul/internal/auth/internal/mappers/trafficpermissionsmapper"
"github.com/hashicorp/consul/internal/auth/internal/types"
"github.com/hashicorp/consul/internal/controller"
"github.com/hashicorp/consul/internal/controller/controllertest"
"github.com/hashicorp/consul/internal/multicluster"
"github.com/hashicorp/consul/internal/resource"
"github.com/hashicorp/consul/internal/resource/resourcetest"
@ -52,13 +52,16 @@ func (suite *controllerSuite) SetupTest() {
suite.isEnterprise = versiontest.IsEnterprise()
suite.tenancies = resourcetest.TestTenancies()
suite.ctx = testutil.TestContext(suite.T())
client := svctest.NewResourceServiceBuilder().
WithRegisterFns(types.Register, multicluster.RegisterTypes).
WithTenancies(append(suite.tenancies, suite.bazTenancy)...).
Run(suite.T())
// TODO: a lot of the fields below should be consolidated to controller only
suite.mapper = trafficpermissionsmapper.New()
suite.sgExpander = expander.GetSamenessGroupExpander()
client := controllertest.NewControllerTestBuilder().
WithResourceRegisterFns(types.Register, multicluster.RegisterTypes).
WithTenancies(append(suite.tenancies, suite.bazTenancy)...).
WithControllerRegisterFns(func(mgr *controller.Manager) {
mgr.Register(Controller(suite.mapper, suite.sgExpander))
}).Run(suite.T())
suite.ctl = controller.NewTestController(
Controller(suite.mapper, suite.sgExpander),
client,
@ -710,6 +713,91 @@ func (suite *controllerSuite) TestReconcile_TrafficPermissionsDelete_Destination
})
}
// 1. Create ALLOW traffic permission granting foo -> bar
// 2. Observe reconciler write CTP for bar listing source foo
// 3. User updates TP from step 1 to instead grant foo -> baz
// 4. Observe reconciler update CTP for bar to list source baz
// 5. (must) Observe reconciler update CTP for bar to default (no permissions)
func TestController_OrphanedTrafficPermissions(t *testing.T) {
client := rtest.NewClient(
controllertest.NewControllerTestBuilder().
WithTenancies(resourcetest.TestTenancies()...).
WithResourceRegisterFns(types.Register).
WithControllerRegisterFns(func(mgr *controller.Manager) {
mgr.Register(Controller(trafficpermissionsmapper.New(), expander.GetSamenessGroupExpander()))
}).
Run(t),
)
for _, tenancy := range resourcetest.TestTenancies() {
t.Run(fmt.Sprintf("%s_Namespace_%s_Partition", tenancy.Namespace, tenancy.Partition), func(t *testing.T) {
// Create the workload identities
foo := rtest.Resource(pbauth.WorkloadIdentityType, "foo").WithTenancy(tenancy).Write(t, client)
bar := rtest.Resource(pbauth.WorkloadIdentityType, "bar").WithTenancy(tenancy).Write(t, client)
baz := rtest.Resource(pbauth.WorkloadIdentityType, "baz").WithTenancy(tenancy).Write(t, client)
// Make the CTP IDs for reference
fooCTPID := resource.ReplaceType(pbauth.ComputedTrafficPermissionsType, foo.Id)
barCTPID := resource.ReplaceType(pbauth.ComputedTrafficPermissionsType, bar.Id)
bazCTPID := resource.ReplaceType(pbauth.ComputedTrafficPermissionsType, baz.Id)
// Create foo -> bar traffic permissions
fooToBarData := &pbauth.TrafficPermissions{
Destination: &pbauth.Destination{
IdentityName: "bar",
},
Action: pbauth.Action_ACTION_ALLOW,
Permissions: []*pbauth.Permission{
{
Sources: []*pbauth.Source{
{
IdentityName: "foo",
Namespace: tenancy.Namespace,
Partition: tenancy.Partition,
},
},
},
},
}
_ = rtest.Resource(pbauth.TrafficPermissionsType, "tp").
WithTenancy(tenancy).
WithData(t, fooToBarData).
Write(t, client)
// Check that CTP for foo exists
_ = client.WaitForResourceExists(t, fooCTPID)
// CTP for bar should list source foo and therefore is not default
barCTP := client.WaitForResourceExists(t, barCTPID)
decodedBarCTP := resourcetest.MustDecode[*pbauth.ComputedTrafficPermissions](t, barCTP)
require.False(t, decodedBarCTP.Data.IsDefault)
// CTP for baz should be default
bazCTP := client.WaitForResourceExists(t, bazCTPID)
decodedBazCTP := resourcetest.MustDecode[*pbauth.ComputedTrafficPermissions](t, bazCTP)
require.True(t, decodedBazCTP.Data.IsDefault)
// Mutate fooToBar to change destination from bar to baz.
// The CTP for bar no longer has references and should be reset on reconcile.
fooToBarData.Destination.IdentityName = "baz"
_ = rtest.Resource(pbauth.TrafficPermissionsType, "tp").
WithTenancy(tenancy).
WithData(t, fooToBarData).
Write(t, client)
// Ensure that the CTP for bar is reverted to default
barCTP = client.WaitForNewVersion(t, barCTPID, barCTP.Version)
decodedBarCTP = resourcetest.MustDecode[*pbauth.ComputedTrafficPermissions](t, barCTP)
require.True(t, decodedBarCTP.Data.IsDefault)
// Ensure that the CTP for baz is no longer default
bazCTP = client.WaitForNewVersion(t, bazCTPID, bazCTP.Version)
decodedBazCTP = resourcetest.MustDecode[*pbauth.ComputedTrafficPermissions](t, bazCTP)
require.False(t, decodedBazCTP.Data.IsDefault)
})
}
}
func (suite *controllerSuite) TestControllerBasic() {
// TODO: refactor this
// In this test we check basic operations for a workload identity and referencing traffic permission

43
internal/auth/internal/controllers/trafficpermissions/index.go
Unescape View File

@ -0,0 +1,43 @@
// Copyright (c) HashiCorp, Inc.
// SPDX-License-Identifier: BUSL-1.1
package trafficpermissions
import (
"github.com/hashicorp/consul/internal/auth/internal/types"
"github.com/hashicorp/consul/internal/controller/cache/index"
"github.com/hashicorp/consul/internal/controller/cache/indexers"
pbauth "github.com/hashicorp/consul/proto-public/pbauth/v2beta1"
"github.com/hashicorp/consul/proto-public/pbresource"
)
const (
TenancyIndexName = "tenancy"
BoundRefsIndexName = "bound-references"
)
func indexNtpByTenancy() *index.Index {
return indexers.DecodedSingleIndexer(
TenancyIndexName,
index.SingleValueFromArgs(func(t *pbresource.Tenancy) ([]byte, error) {
return index.IndexFromTenancy(t), nil
}),
func(r *types.DecodedNamespaceTrafficPermissions) (bool, []byte, error) {
return true, index.IndexFromTenancy(r.Id.Tenancy), nil
},
)
}
func indexPtpByTenancy() *index.Index {
return indexers.DecodedSingleIndexer(
TenancyIndexName,
index.SingleValueFromArgs(func(t *pbresource.Tenancy) ([]byte, error) {
return index.IndexFromTenancy(t), nil
}),
func(r *types.DecodedPartitionTrafficPermissions) (bool, []byte, error) {
return true, index.IndexFromTenancy(r.Id.Tenancy), nil
},
)
}
var boundRefsIndex = indexers.BoundRefsIndex[*pbauth.ComputedTrafficPermissions](BoundRefsIndexName)

101
proto-public/pbauth/v2beta1/computed_traffic_permissions.pb.go
Unescape View File

@ -10,7 +10,7 @@
package authv2beta1
import (
_ "github.com/hashicorp/consul/proto-public/pbresource"
pbresource "github.com/hashicorp/consul/proto-public/pbresource"
protoreflect "google.golang.org/protobuf/reflect/protoreflect"
protoimpl "google.golang.org/protobuf/runtime/protoimpl"
reflect "reflect"
@ -32,6 +32,9 @@ type ComputedTrafficPermissions struct {
AllowPermissions []*Permission `protobuf:"bytes,1,rep,name=allow_permissions,json=allowPermissions,proto3" json:"allow_permissions,omitempty"`
DenyPermissions []*Permission `protobuf:"bytes,2,rep,name=deny_permissions,json=denyPermissions,proto3" json:"deny_permissions,omitempty"`
IsDefault bool `protobuf:"varint,3,opt,name=is_default,json=isDefault,proto3" json:"is_default,omitempty"`
// BoundReferences is a slice of mixed type references of resources that were
// involved in the formulation of this resource.
BoundReferences []*pbresource.Reference `protobuf:"bytes,4,rep,name=bound_references,json=boundReferences,proto3" json:"bound_references,omitempty"`
}
func (x *ComputedTrafficPermissions) Reset() {
@ -87,6 +90,13 @@ func (x *ComputedTrafficPermissions) GetIsDefault() bool {
return false
}
func (x *ComputedTrafficPermissions) GetBoundReferences() []*pbresource.Reference {
if x != nil {
return x.BoundReferences
}
return nil
}
var File_pbauth_v2beta1_computed_traffic_permissions_proto protoreflect.FileDescriptor
var file_pbauth_v2beta1_computed_traffic_permissions_proto_rawDesc = []byte{
@ -99,41 +109,48 @@ var file_pbauth_v2beta1_computed_traffic_permissions_proto_rawDesc = []byte{
0x61, 0x31, 0x2f, 0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x5f, 0x70, 0x65, 0x72, 0x6d, 0x69,
0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1c, 0x70, 0x62,
0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74,
0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xf1, 0x01, 0x0a, 0x1a, 0x43,
0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x64, 0x54, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x50, 0x65,
0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x56, 0x0a, 0x11, 0x61, 0x6c, 0x6c,
0x6f, 0x77, 0x5f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01,
0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x32, 0x62,
0x65, 0x74, 0x61, 0x31, 0x2e, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52,
0x10, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e,
0x73, 0x12, 0x54, 0x0a, 0x10, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73,
0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x68, 0x61,
0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x61,
0x75, 0x74, 0x68, 0x2e, 0x76, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x50, 0x65, 0x72, 0x6d,
0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x0f, 0x64, 0x65, 0x6e, 0x79, 0x50, 0x65, 0x72, 0x6d,
0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x73, 0x5f, 0x64, 0x65,
0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44,
0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x3a, 0x06, 0xa2, 0x93, 0x04, 0x02, 0x08, 0x03, 0x42, 0xa0,
0x02, 0x0a, 0x21, 0x63, 0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70,
0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x32, 0x62,
0x65, 0x74, 0x61, 0x31, 0x42, 0x1f, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x64, 0x54, 0x72,
0x61, 0x66, 0x66, 0x69, 0x63, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73,
0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
0x63, 0x6f, 0x6d, 0x2f, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f,
0x6e, 0x73, 0x75, 0x6c, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69,
0x63, 0x2f, 0x70, 0x62, 0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31,
0x3b, 0x61, 0x75, 0x74, 0x68, 0x76, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48,
0x43, 0x41, 0xaa, 0x02, 0x1d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43,
0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x2e, 0x56, 0x32, 0x62, 0x65, 0x74,
0x61, 0x31, 0xca, 0x02, 0x1d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43,
0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x41, 0x75, 0x74, 0x68, 0x5c, 0x56, 0x32, 0x62, 0x65, 0x74,
0x61, 0x31, 0xe2, 0x02, 0x29, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43,
0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x5c, 0x41, 0x75, 0x74, 0x68, 0x5c, 0x56, 0x32, 0x62, 0x65, 0x74,
0x61, 0x31, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02,
0x20, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73,
0x75, 0x6c, 0x3a, 0x3a, 0x41, 0x75, 0x74, 0x68, 0x3a, 0x3a, 0x56, 0x32, 0x62, 0x65, 0x74, 0x61,
0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
0x69, 0x6f, 0x6e, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x70, 0x62, 0x72, 0x65,
0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc2, 0x02, 0x0a, 0x1a, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74,
0x65, 0x64, 0x54, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73,
0x69, 0x6f, 0x6e, 0x73, 0x12, 0x56, 0x0a, 0x11, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x70, 0x65,
0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73,
0x75, 0x6c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e,
0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x10, 0x61, 0x6c, 0x6c, 0x6f,
0x77, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x54, 0x0a, 0x10,
0x64, 0x65, 0x6e, 0x79, 0x5f, 0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73,
0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f,
0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76,
0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0x2e, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f,
0x6e, 0x52, 0x0f, 0x64, 0x65, 0x6e, 0x79, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f,
0x6e, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x69, 0x73, 0x5f, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74,
0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x69, 0x73, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c,
0x74, 0x12, 0x4f, 0x0a, 0x10, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x72, 0x65, 0x66, 0x65, 0x72,
0x65, 0x6e, 0x63, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x68, 0x61,
0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x2e, 0x72,
0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63,
0x65, 0x52, 0x0f, 0x62, 0x6f, 0x75, 0x6e, 0x64, 0x52, 0x65, 0x66, 0x65, 0x72, 0x65, 0x6e, 0x63,
0x65, 0x73, 0x3a, 0x06, 0xa2, 0x93, 0x04, 0x02, 0x08, 0x03, 0x42, 0xa0, 0x02, 0x0a, 0x21, 0x63,
0x6f, 0x6d, 0x2e, 0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x63, 0x6f, 0x6e,
0x73, 0x75, 0x6c, 0x2e, 0x61, 0x75, 0x74, 0x68, 0x2e, 0x76, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31,
0x42, 0x1f, 0x43, 0x6f, 0x6d, 0x70, 0x75, 0x74, 0x65, 0x64, 0x54, 0x72, 0x61, 0x66, 0x66, 0x69,
0x63, 0x50, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x50, 0x72, 0x6f, 0x74,
0x6f, 0x50, 0x01, 0x5a, 0x43, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
0x68, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2f, 0x63, 0x6f, 0x6e, 0x73, 0x75, 0x6c,
0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x2f, 0x70, 0x62,
0x61, 0x75, 0x74, 0x68, 0x2f, 0x76, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0x3b, 0x61, 0x75, 0x74,
0x68, 0x76, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0xa2, 0x02, 0x03, 0x48, 0x43, 0x41, 0xaa, 0x02,
0x1d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x2e, 0x43, 0x6f, 0x6e, 0x73, 0x75,
0x6c, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x2e, 0x56, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0xca, 0x02,
0x1d, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75,
0x6c, 0x5c, 0x41, 0x75, 0x74, 0x68, 0x5c, 0x56, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0xe2, 0x02,
0x29, 0x48, 0x61, 0x73, 0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x5c, 0x43, 0x6f, 0x6e, 0x73, 0x75,
0x6c, 0x5c, 0x41, 0x75, 0x74, 0x68, 0x5c, 0x56, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0x5c, 0x47,
0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x20, 0x48, 0x61, 0x73,
0x68, 0x69, 0x63, 0x6f, 0x72, 0x70, 0x3a, 0x3a, 0x43, 0x6f, 0x6e, 0x73, 0x75, 0x6c, 0x3a, 0x3a,
0x41, 0x75, 0x74, 0x68, 0x3a, 0x3a, 0x56, 0x32, 0x62, 0x65, 0x74, 0x61, 0x31, 0x62, 0x06, 0x70,
0x72, 0x6f, 0x74, 0x6f, 0x33,
}
var (
@ -152,15 +169,17 @@ var file_pbauth_v2beta1_computed_traffic_permissions_proto_msgTypes = make([]pro
var file_pbauth_v2beta1_computed_traffic_permissions_proto_goTypes = []interface{}{
(*ComputedTrafficPermissions)(nil), // 0: hashicorp.consul.auth.v2beta1.ComputedTrafficPermissions
(*Permission)(nil), // 1: hashicorp.consul.auth.v2beta1.Permission
(*pbresource.Reference)(nil), // 2: hashicorp.consul.resource.Reference
}
var file_pbauth_v2beta1_computed_traffic_permissions_proto_depIdxs = []int32{
1, // 0: hashicorp.consul.auth.v2beta1.ComputedTrafficPermissions.allow_permissions:type_name -> hashicorp.consul.auth.v2beta1.Permission
1, // 1: hashicorp.consul.auth.v2beta1.ComputedTrafficPermissions.deny_permissions:type_name -> hashicorp.consul.auth.v2beta1.Permission
2, // [2:2] is the sub-list for method output_type
2, // [2:2] is the sub-list for method input_type
2, // [2:2] is the sub-list for extension type_name
2, // [2:2] is the sub-list for extension extendee
0, // [0:2] is the sub-list for field type_name
2, // 2: hashicorp.consul.auth.v2beta1.ComputedTrafficPermissions.bound_references:type_name -> hashicorp.consul.resource.Reference
3, // [3:3] is the sub-list for method output_type
3, // [3:3] is the sub-list for method input_type
3, // [3:3] is the sub-list for extension type_name
3, // [3:3] is the sub-list for extension extendee
0, // [0:3] is the sub-list for field type_name
}
func init() { file_pbauth_v2beta1_computed_traffic_permissions_proto_init() }

5
proto-public/pbauth/v2beta1/computed_traffic_permissions.proto
Unescape View File

@ -7,6 +7,7 @@ package hashicorp.consul.auth.v2beta1;
import "pbauth/v2beta1/traffic_permissions.proto";
import "pbresource/annotations.proto";
import "pbresource/resource.proto";
message ComputedTrafficPermissions {
option (hashicorp.consul.resource.spec) = {scope: SCOPE_NAMESPACE};
@ -14,4 +15,8 @@ message ComputedTrafficPermissions {
repeated Permission allow_permissions = 1;
repeated Permission deny_permissions = 2;
bool is_default = 3;
// BoundReferences is a slice of mixed type references of resources that were
// involved in the formulation of this resource.
repeated hashicorp.consul.resource.Reference bound_references = 4;
}

Write Preview
Loading…
Cancel
Save