Audit access policy implementation #12846
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
alpeb
added a commit
that referenced
this pull request
Jul 16, 2024
Followup to #12846, branched off alpeb/policy-audit-impl This fixes the policy controller unit and integration tests by accounting for the new Audit default policy and the new accessPolicy field in Server. New integration tests added: - e2e_audit.rs exercising first the audit policy in Server, and then at the namespace level - in admit_server.rs a new test checks invalid accessPolicy values are rejected. - in inbound_api.rs server_with_audit_policy verifies the synthesized audit authorization is returned for a Server with accessPolicy=audit
mateiidavid
reviewed
Jul 16, 2024
mateiidavid
approved these changes
Jul 17, 2024
alpeb
force-pushed
the
alpeb/policy-audit-crd
branch
from
3bad724 to
d537592
Compare
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
from
60ccfec to
7cf3c97
Compare
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
from
7cf3c97 to
dd2c9fa
Compare
adleong
reviewed
Jul 22, 2024
|
Ready for review again 👍 Note the CI Rust failures are from the tests, which I've addressed separately in #12847 |
adleong
approved these changes
Jul 23, 2024
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
2 times, most recently
from
a9caff0 to
a0ded8a
Compare
alpeb
added a commit
that referenced
this pull request
Jul 23, 2024
Followup to #12846, branched off alpeb/policy-audit-impl This fixes the policy controller unit and integration tests by accounting for the new Audit default policy and the new accessPolicy field in Server. New integration tests added: - e2e_audit.rs exercising first the audit policy in Server, and then at the namespace level - in admit_server.rs a new test checks invalid accessPolicy values are rejected. - in inbound_api.rs server_with_audit_policy verifies the synthesized audit authorization is returned for a Server with accessPolicy=audit
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
from
a0ded8a to
5ff8d95
Compare
alpeb
added a commit
that referenced
this pull request
Jul 25, 2024
Followup to #12846, branched off alpeb/policy-audit-impl This fixes the policy controller unit and integration tests by accounting for the new Audit default policy and the new accessPolicy field in Server. New integration tests added: - e2e_audit.rs exercising first the audit policy in Server, and then at the namespace level - in admit_server.rs a new test checks invalid accessPolicy values are rejected. - in inbound_api.rs server_with_audit_policy verifies the synthesized audit authorization is returned for a Server with accessPolicy=audit
Followup to #12845 This expands the policy controller index in the following ways: - Adds the new Audit variant to the DefaultPolicy enum - Expands the function that synthesizes the authorizations for a given default policy (DefaultPolicy::default_authzs) so that it also creates an Unauthenticated client auth and a allow-all NetworkMatch for the new Audit default policy. - Now that a Server can have a default policy different than Deny, when generating InboundServer authorizations (PolicyIndex::client_authzs) make sure to append the default authorizations when DefaultPolicy is Allow or Audit Also, the admission controller ensures the new accessPolicy field contains a valid value. Required test changes are addressed in #12847. Also note you'll need the proxy changes at linkerd/linkerd2-proxy#3068 to make this work. Please check linkerd/website#1805 for how this is supposed to work from the user's perspective.
alpeb
force-pushed
the
alpeb/policy-audit-impl
branch
from
5ff8d95 to
9ad80a5
Compare
alpeb
added a commit
that referenced
this pull request
Jul 26, 2024
Followup to #12846, branched off alpeb/policy-audit-impl This fixes the policy controller unit and integration tests by accounting for the new Audit default policy and the new accessPolicy field in Server. New integration tests added: - e2e_audit.rs exercising first the audit policy in Server, and then at the namespace level - in admit_server.rs a new test checks invalid accessPolicy values are rejected. - in inbound_api.rs server_with_audit_policy verifies the synthesized audit authorization is returned for a Server with accessPolicy=audit
Followup to #12846, branched off alpeb/policy-audit-impl This fixes the policy controller unit and integration tests by accounting for the new Audit default policy and the new accessPolicy field in Server. New integration tests added: - e2e_audit.rs exercising first the audit policy in Server, and then at the namespace level - in admit_server.rs a new test checks invalid accessPolicy values are rejected. - in inbound_api.rs server_with_audit_policy verifies the synthesized audit authorization is returned for a Server with accessPolicy=audit Please check linkerd/website#1805 for how this is supposed to work from the user's perspective.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Followup to #12845
This expands the policy controller index in the following ways:
Also, the admission controller ensures the new accessPolicy field contains a valid value.
Tests
New integration tests added:
Note
Please check linkerd/website#1805 for how this is supposed to work from the user's perspective.