Fix issue with trust bundle read ACL check. (#16630)
This commit fixes an issue where trust bundles could not be read by services in a non-default namespace, unless they had excessive ACL permissions given to them. Prior to this change, `service:write` was required in the default namespace in order to read the trust bundle. Now, `service:write` to a service in any namespace is sufficient.
This commit is contained in:
parent
0ad653b5bb
commit
f3be5d9b80
|
@ -0,0 +1,3 @@
|
|||
```release-note:bug
|
||||
peering: **(Consul Enterprise only)** Fix issue where connect-enabled services with peer upstreams incorrectly required `service:write` access in the `default` namespace to query data, which was too restrictive. Now having `service:write` to any namespace is sufficient to query the peering data.
|
||||
```
|
|
@ -33,12 +33,14 @@ type serverTrustBundle struct {
|
|||
}
|
||||
|
||||
func (s *serverTrustBundle) Notify(ctx context.Context, req *cachetype.TrustBundleReadRequest, correlationID string, ch chan<- proxycfg.UpdateEvent) error {
|
||||
entMeta := structs.NodeEnterpriseMetaInPartition(req.Request.Partition)
|
||||
// Having the ability to write a service in ANY (at least one) namespace should be
|
||||
// sufficient for reading the trust bundle, which is why we use a wildcard.
|
||||
entMeta := acl.NewEnterpriseMetaWithPartition(req.Request.Partition, acl.WildcardName)
|
||||
|
||||
return watch.ServerLocalNotify(ctx, correlationID, s.deps.GetStore,
|
||||
func(ws memdb.WatchSet, store Store) (uint64, *pbpeering.TrustBundleReadResponse, error) {
|
||||
var authzCtx acl.AuthorizerContext
|
||||
authz, err := s.deps.ACLResolver.ResolveTokenAndDefaultMeta(req.Token, entMeta, &authzCtx)
|
||||
authz, err := s.deps.ACLResolver.ResolveTokenAndDefaultMeta(req.Token, &entMeta, &authzCtx)
|
||||
if err != nil {
|
||||
return 0, nil, err
|
||||
}
|
||||
|
|
|
@ -924,9 +924,12 @@ func (s *Server) TrustBundleRead(ctx context.Context, req *pbpeering.TrustBundle
|
|||
|
||||
defer metrics.MeasureSince([]string{"peering", "trust_bundle_read"}, time.Now())
|
||||
|
||||
// Having the ability to write a service in ANY (at least one) namespace should be
|
||||
// sufficient for reading the trust bundle, which is why we use a wildcard.
|
||||
entMeta := acl.NewEnterpriseMetaWithPartition(req.Partition, acl.WildcardName)
|
||||
entMeta.Normalize()
|
||||
var authzCtx acl.AuthorizerContext
|
||||
entMeta := structs.DefaultEnterpriseMetaInPartition(req.Partition)
|
||||
authz, err := s.Backend.ResolveTokenAndDefaultMeta(options.Token, entMeta, &authzCtx)
|
||||
authz, err := s.Backend.ResolveTokenAndDefaultMeta(options.Token, &entMeta, &authzCtx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
@ -937,7 +940,7 @@ func (s *Server) TrustBundleRead(ctx context.Context, req *pbpeering.TrustBundle
|
|||
|
||||
idx, trustBundle, err := s.Backend.Store().PeeringTrustBundleRead(nil, state.Query{
|
||||
Value: req.Name,
|
||||
EnterpriseMeta: *entMeta,
|
||||
EnterpriseMeta: entMeta,
|
||||
})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to read trust bundle for peer %s: %w", req.Name, err)
|
||||
|
|
Loading…
Reference in New Issue