luxolus
/
open-consul
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity

Backport of Allow service identity tokens the ability to read jwt-providers into release/1.16.x (#17896) 

* backport of commit 72308dd9f2a17db4c7c8ea7eabb55db3adadaa91

* backport of commit bf5d1ec2ec68fd7428027244a094baeee49d4396

* backport of commit 4ca2e4be490655948f7480cbc182c6cca7cec0a9

---------

Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>
This commit is contained in:
hc-github-team-consul-core 2023-06-27 12:07:32 -05:00 committed by GitHub
parent 4da9985ebf
commit 97ed887e40
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
agent/structs/config_entry_jwt_provider.go
View File

@ -316,6 +316,15 @@ func (e *JWTProviderConfigEntry) GetRaftIndex() *RaftIndex { retur
func (e *JWTProviderConfigEntry) CanRead(authz acl.Authorizer) error { func (e *JWTProviderConfigEntry) CanRead(authz acl.Authorizer) error {
var authzContext acl.AuthorizerContext var authzContext acl.AuthorizerContext
e.FillAuthzContext(&authzContext) e.FillAuthzContext(&authzContext)
// allow service-identity tokens the ability to read jwt-providers
// this is a workaround to allow sidecar proxies to read the jwt-providers
// see issue: https://github.com/hashicorp/consul/issues/17886 for more details
err := authz.ToAllowAuthorizer().ServiceWriteAnyAllowed(&authzContext)
if err == nil {
return err
}
return authz.ToAllowAuthorizer().MeshReadAllowed(&authzContext) return authz.ToAllowAuthorizer().MeshReadAllowed(&authzContext)
} }

18
agent/structs/config_entry_jwt_provider_test.go
View File

@ -338,6 +338,24 @@ func TestJWTProviderConfigEntry_ACLs(t *testing.T) {
canRead: false, canRead: false,
canWrite: false, canWrite: false,
}, },
{
name: "jwt-provider: any service write",
authorizer: newTestAuthz(t, `service "" { policy = "write" }`),
canRead: true,
canWrite: false,
},
{
name: "jwt-provider: specific service write",
authorizer: newTestAuthz(t, `service "web" { policy = "write" }`),
canRead: true,
canWrite: false,
},
{
name: "jwt-provider: any service prefix write",
authorizer: newTestAuthz(t, `service_prefix "" { policy = "write" }`),
canRead: true,
canWrite: false,
},
{ {
name: "jwt-provider: mesh read", name: "jwt-provider: mesh read",
authorizer: newTestAuthz(t, `mesh = "read"`), authorizer: newTestAuthz(t, `mesh = "read"`),