add what-can-i-do endpoint #8675

deads2k · 2016-04-28T20:30:33Z

Let's argue about names. This as a REST endpoint and a command (oc policy can-i --list) that gives back a list of all the policy rules that a given user has in namespace. I need a good name for the resource and kind.

I want one endpoint for determining it about yourself (with scopes properly applied) and one for determining it about someone else. Having two endpoints makes it easier to write policy rules without introspection.

Things that are missing:

the "someone else" endpoint - willl make issue.
normalization of the rules to neatly bundle by resource tuples, collapsing for identical verbs and names - turns out our rules don't look too bad as-is.
tests
respect for scopes (scopes haven't merged yet) - can't reasonably do without scopes having merged

@jwforres @spadgett you both asked for this. I don't intend to associate the list in any particular way.
@openshift/api-review PertinentPermissions and PersonalPertinentPermissions?

smarterclayton · 2016-04-28T21:03:04Z

The call returns policy rules. So PolicyRulesReview or SubjectRulesReview
is at least consistent with our existing resources.

On Thu, Apr 28, 2016 at 4:40 PM, David Eads [email protected]
wrote:

Let's argue about names. This as a REST endpoint and a command (oc policy
what-can-i-do) that gives back a list of all the policy rules that a
given user has in namespace. I need a good name for the resource and kind.

I want one endpoint for determining it about yourself (with scopes
properly applied) and one for determining it about someone else. Having two
endpoints makes it easier to write policy rules without introspection.

Things that are missing:

the "someone else" endpoint

normalization of the rules to neatly bundle by resource tuples,
collapsing for identical verbs and names

tests

respect for scopes (scopes haven't merged yet)

@jwforres https://github.com/jwforres @spadgett
https://github.com/spadgett you both asked for this. I don't intend to
associate the list in any particular way.
@openshift/api-review https://github.com/orgs/openshift/teams/api-review

PertinentPermissions and PersonalPertinentPermissions?

You can view, comment on, or merge this pull request online at:

#8675
Commit Summary

add what-can-i-do endpoint

File Changes

M pkg/authorization/api/register.go
https://github.com/openshift/origin/pull/8675/files#diff-0 (2)

M pkg/authorization/api/types.go
https://github.com/openshift/origin/pull/8675/files#diff-1 (11)

M pkg/authorization/api/v1/register.go
https://github.com/openshift/origin/pull/8675/files#diff-2 (2)

M pkg/authorization/api/v1/types.go
https://github.com/openshift/origin/pull/8675/files#diff-3 (11)

M pkg/authorization/api/v1beta3/register.go
https://github.com/openshift/origin/pull/8675/files#diff-4 (2)

M pkg/authorization/api/v1beta3/types.go
https://github.com/openshift/origin/pull/8675/files#diff-5 (11)

A pkg/authorization/registry/whatcanido/storage.go
https://github.com/openshift/origin/pull/8675/files#diff-6 (39)

M pkg/authorization/rulevalidation/policy_comparator.go
https://github.com/openshift/origin/pull/8675/files#diff-7 (14)

M pkg/client/client.go
https://github.com/openshift/origin/pull/8675/files#diff-8 (5)

A pkg/client/whatcanido.go
https://github.com/openshift/origin/pull/8675/files#diff-9 (32)

A pkg/cmd/admin/policy/whatcanido.go
https://github.com/openshift/origin/pull/8675/files#diff-10 (74)

M pkg/cmd/cli/policy/policy.go
https://github.com/openshift/origin/pull/8675/files#diff-11 (1)

M pkg/cmd/server/bootstrappolicy/policy.go
https://github.com/openshift/origin/pull/8675/files#diff-12 (1)

M pkg/cmd/server/origin/master.go
https://github.com/openshift/origin/pull/8675/files#diff-13 (4)

M pkg/cmd/server/origin/master_config.go
https://github.com/openshift/origin/pull/8675/files#diff-14 (19)

Patch Links:

https://github.com/openshift/origin/pull/8675.patch

https://github.com/openshift/origin/pull/8675.diff

—
You are receiving this because you are on a team that was mentioned.
Reply to this email directly or view it on GitHub
#8675

deads2k · 2016-04-28T21:13:12Z

The call returns policy rules. So PolicyRulesReview or SubjectRulesReview
is at least consistent with our existing resources.

SubjectRulesReview and SelfSubjectRulesReview? That would match SubjectAccessReview and SelfSubjectAccessReview upstream.

smarterclayton · 2016-04-28T21:38:46Z

Yeah those make sense.

On Thu, Apr 28, 2016 at 5:13 PM, David Eads [email protected]
wrote:

The call returns policy rules. So PolicyRulesReview or SubjectRulesReview
is at least consistent with our existing resources.

SubjectRulesReview and SelfSubjectRulesReview? That would match
SubjectAccessReview and SelfSubjectAccessReview upstream.

—
You are receiving this because you are on a team that was mentioned.
Reply to this email directly or view it on GitHub
#8675 (comment)

deads2k · 2016-04-29T18:36:26Z

@smarterclayton updated to SelfSubjectRulesReview.

@pweil- got a reviewer in mind?

deads2k · 2016-04-29T18:36:56Z

@sgallagher you're interested in RESTStorage, clients, and cli commands, right? :)

deads2k · 2016-04-29T18:37:08Z

[test]

pweil- · 2016-04-29T18:42:11Z

got a reviewer in mind

@sgallagher loves this kind of stuff 😄

@sdminonne if you have some time since this is probably similar to the SCC checks you're looking at.

openshift-bot · 2016-05-02T12:35:14Z

Evaluated for origin test up to 257ecaa

openshift-bot · 2016-05-02T13:29:31Z

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/3521/)

deads2k · 2016-05-02T13:44:59Z

Request:

{"kind":"SelfSubjectRulesReview","apiVersion":"v1","status":{"rules":null}}

Response

{
    "kind": "SelfSubjectRulesReview",
    "apiVersion": "v1",
    "status": {
        "rules": [{
            "verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
            "attributeRestrictions": null,
            "apiGroups": [""],
            "resources": ["configmaps", "endpoints", "persistentvolumeclaims", "pods", "pods/attach", "pods/exec", "pods/log", "pods/portforward", "pods/proxy", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
        }, {
            "verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
            "attributeRestrictions": null,
            "apiGroups": [""],
            "resources": ["buildconfigs", "buildconfigs/instantiate", "buildconfigs/instantiatebinary", "buildconfigs/webhooks", "buildlogs", "builds", "builds/clone", "builds/log", "deploymentconfigrollbacks", "deploymentconfigs", "deploymentconfigs/log", "deploymentconfigs/scale", "deployments", "generatedeploymentconfigs", "imagestreamimages", "imagestreamimports", "imagestreammappings", "imagestreams", "imagestreams/secrets", "imagestreamtags", "localresourceaccessreviews", "localsubjectaccessreviews", "processedtemplates", "projects", "resourceaccessreviews", "rolebindings", "roles", "routes", "subjectaccessreviews", "templateconfigs", "templates"]
        }, {
            "verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
            "attributeRestrictions": null,
            "apiGroups": ["autoscaling"],
            "resources": ["horizontalpodautoscalers"]
        }, {
            "verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
            "attributeRestrictions": null,
            "apiGroups": ["batch"],
            "resources": ["jobs"]
        }, {
            "verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
            "attributeRestrictions": null,
            "apiGroups": ["extensions"],
            "resources": ["horizontalpodautoscalers", "jobs", "replicationcontrollers/scale"]
        }, {
            "verbs": ["get", "list", "watch"],
            "attributeRestrictions": null,
            "apiGroups": ["extensions"],
            "resources": ["daemonsets"]
        }, {
            "verbs": ["get", "list", "watch"],
            "attributeRestrictions": null,
            "apiGroups": null,
            "resources": ["bindings", "configmaps", "endpoints", "events", "imagestreams/status", "limitranges", "minions", "namespaces", "namespaces/status", "nodes", "persistentvolumeclaims", "persistentvolumes", "pods", "pods/log", "pods/status", "policies", "policybindings", "replicationcontrollers", "replicationcontrollers/status", "resourcequotas", "resourcequotas/status", "resourcequotausages", "routes/status", "securitycontextconstraints", "serviceaccounts", "services"]
        }, {
            "verbs": ["get", "update"],
            "attributeRestrictions": null,
            "apiGroups": null,
            "resources": ["imagestreams/layers"]
        }, {
            "verbs": ["update"],
            "attributeRestrictions": null,
            "apiGroups": null,
            "resources": ["routes/status"]
        }]
    }
}

jwforres · 2016-05-02T14:07:42Z

sample response LGTM, this is what the UI needs

On Mon, May 2, 2016 at 9:45 AM, David Eads [email protected] wrote:

Request:

{"kind":"SelfSubjectRulesReview","apiVersion":"v1","status":{"rules":null}}

Response

{
"kind": "SelfSubjectRulesReview",
"apiVersion": "v1",
"status": {
"rules": [{
"verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": [""],
"resources": ["configmaps", "endpoints", "persistentvolumeclaims", "pods", "pods/attach", "pods/exec", "pods/log", "pods/portforward", "pods/proxy", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": [""],
"resources": ["buildconfigs", "buildconfigs/instantiate", "buildconfigs/instantiatebinary", "buildconfigs/webhooks", "buildlogs", "builds", "builds/clone", "builds/log", "deploymentconfigrollb!
acks", "deploymentconfigs", "deploymentconfigs/log", "deploymentconfigs/scale", "deployments", "generatedeploymentconfigs", "imagestreamimages", "imagestreamimports", "imagestreammappings", "imagestreams", "imagestreams/secrets", "imagestreamtags", "localresourceaccessreviews", "localsubjectaccessreviews", "processedtemplates", "projects", "resourceaccessreviews", "rolebindings", "roles", "routes",!
"subjectaccessreviews", "templateconfigs", "templates"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": ["autoscaling"],
"resources": ["horizontalpodautoscalers"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": ["batch"],
"resources": ["jobs"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": ["extensions"],
"resources": ["horizontalpodautoscalers", "jobs", "replicationcontrollers/scale"]
}, {
"verbs": ["get", "list", "watch"],
"attributeRestrictions": null,
"apiGroups": ["extensions"],
"resources": ["daemonsets"]
}, {
"verbs": ["get", "list", "watch"],
"attributeRestrictions": null,
"apiGroups": null,
"resources": ["bindings", "configmaps", "endpoints", "events", "imagestreams/status", "limitranges", "minions", "namespaces", "namespaces/status",
"nodes", "persistentvolumeclaims", "persistentvolumes", "pods", "pods/log", "pods/status", "policies", "policybindings", "replicationcontrollers", "replicationcontrollers/status", "resourcequotas", "resourcequotas/status", "resourcequotausages", "routes/status", "securitycontextconstraints", "serviceaccounts", "services"]
}, {
"verbs": ["get", "update"],
"attributeRestrictions": null,
"apiGroups": null,
"resources": ["imagestreams/layers"]
}, {
"verbs": ["update"],
"attributeRestrictions": null,
"apiGroups": null,
"resources": ["routes/status"]
}]
}
}

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8675 (comment)

smarterclayton · 2016-05-02T15:32:32Z

Not sure whether I like "what-can-I-do" as a command name but it's fine for
now.

On Mon, May 2, 2016 at 10:07 AM, Jessica Forrester <[email protected]

wrote:

sample response LGTM, this is what the UI needs

On Mon, May 2, 2016 at 9:45 AM, David Eads [email protected]
wrote:

Request:

{"kind":"SelfSubjectRulesReview","apiVersion":"v1","status":{"rules":null}}

Response

{
"kind": "SelfSubjectRulesReview",
"apiVersion": "v1",
"status": {
"rules": [{
"verbs": ["create", "delete", "deletecollection", "get", "list",
"patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": [""],
"resources": ["configmaps", "endpoints", "persistentvolumeclaims",
"pods", "pods/attach", "pods/exec", "pods/log", "pods/portforward",
"pods/proxy", "replicationcontrollers", "replicationcontrollers/scale",
"secrets", "serviceaccounts", "services", "services/proxy"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list",
"patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": [""],
"resources": ["buildconfigs", "buildconfigs/instantiate",
"buildconfigs/instantiatebinary", "buildconfigs/webhooks", "buildlogs",
"builds", "builds/clone", "builds/log", "deploymentconfigrollb!
acks", "deploymentconfigs", "deploymentconfigs/log",
"deploymentconfigs/scale", "deployments", "generatedeploymentconfigs",
"imagestreamimages", "imagestreamimports", "imagestreammappings",
"imagestreams", "imagestreams/secrets", "imagestreamtags",
"localresourceaccessreviews", "localsubjectaccessreviews",
"processedtemplates", "projects", "resourceaccessreviews", "rolebindings",
"roles", "routes",!
"subjectaccessreviews", "templateconfigs", "templates"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list",
"patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": ["autoscaling"],
"resources": ["horizontalpodautoscalers"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list",
"patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": ["batch"],
"resources": ["jobs"]
}, {
"verbs": ["create", "delete", "deletecollection", "get", "list",
"patch", "update", "watch"],
"attributeRestrictions": null,
"apiGroups": ["extensions"],
"resources": ["horizontalpodautoscalers", "jobs",
"replicationcontrollers/scale"]
}, {
"verbs": ["get", "list", "watch"],
"attributeRestrictions": null,
"apiGroups": ["extensions"],
"resources": ["daemonsets"]
}, {
"verbs": ["get", "list", "watch"],
"attributeRestrictions": null,
"apiGroups": null,
"resources": ["bindings", "configmaps", "endpoints", "events",
"imagestreams/status", "limitranges", "minions", "namespaces",
"namespaces/status",
"nodes", "persistentvolumeclaims", "persistentvolumes", "pods",
"pods/log", "pods/status", "policies", "policybindings",
"replicationcontrollers", "replicationcontrollers/status",
"resourcequotas", "resourcequotas/status", "resourcequotausages",
"routes/status", "securitycontextconstraints", "serviceaccounts",
"services"]
}, {
"verbs": ["get", "update"],
"attributeRestrictions": null,
"apiGroups": null,
"resources": ["imagestreams/layers"]
}, {
"verbs": ["update"],
"attributeRestrictions": null,
"apiGroups": null,
"resources": ["routes/status"]
}]
}
}

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8675 (comment)

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8675 (comment)

deads2k · 2016-05-02T17:05:38Z

Not sure whether I like "what-can-I-do" as a command name but it's fine for
now.

And the API object names?

sgallagher · 2016-05-03T00:20:50Z

"list-authorized-actions"?

smarterclayton · 2016-05-03T00:28:05Z

API was approved

On May 2, 2016, at 1:05 PM, David Eads [email protected] wrote:

Not sure whether I like "what-can-I-do" as a command name but it's fine for
now.

And the API object names?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#8675 (comment)

deads2k · 2016-05-03T11:56:44Z

"list-authorized-actions"?

We get until the next tag to pin the command down. I was leaning towards oc policy can-i <verb> <resource> and oc policy can-i --list.

@sgallagher any other comments?

sgallagher · 2016-05-03T17:27:42Z

LGTM

I built it and played around with setting some policy roles on a user and can verify that they appear to work properly.

deads2k · 2016-05-03T18:18:47Z

[merge]

openshift-bot · 2016-05-03T19:55:20Z

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_origin/5795/) (Image: devenv-rhel7_4088)

deads2k · 2016-05-03T20:14:23Z

@jwforres I don't think I touched bindata, but I'm getting this:

--- _output/test/assets/bindata.go  2016-05-03 15:51:07.213436061 -0400
+++ pkg/assets/bindata.go   2016-05-03 15:00:33.666020369 -0400
@@ -48373,12 +48373,9 @@
 }
 function p() {
 try {
-var a = Intl.DateTimeFormat().resolvedOptions().timeZone;
-if (a) {
-var b = H[r(a)];
+var a = Intl.DateTimeFormat().resolvedOptions().timeZone, b = H[r(a)];
make[1]: *** [test-assets] Error 141

liggitt · 2016-05-03T20:15:18Z

known issue, fixed in #8725

deads2k · 2016-05-03T20:35:57Z

re[merge]

openshift-bot · 2016-05-03T20:40:21Z

Evaluated for origin merge up to 257ecaa

deads2k added the needs-api-review label Apr 28, 2016

deads2k force-pushed the what-can-i-do branch 3 times, most recently from 58e13c2 to 3a03dfd Compare April 29, 2016 17:36

deads2k changed the title ~~[WIP] add what-can-i-do endpoint~~ add what-can-i-do endpoint Apr 29, 2016

deads2k force-pushed the what-can-i-do branch from 3a03dfd to 16a8c62 Compare April 29, 2016 19:49

add what-can-i-do endpoint

257ecaa

deads2k force-pushed the what-can-i-do branch from 16a8c62 to 257ecaa Compare May 2, 2016 12:31

deads2k assigned sgallagher May 2, 2016

smarterclayton added api-approved and removed needs-api-review labels May 3, 2016

openshift-bot merged commit 8f127d7 into openshift:master May 3, 2016

deads2k mentioned this pull request May 9, 2016

registry-editor & registry-viewer role should be able to list rolebindings in project. #8791

Closed

deads2k deleted the what-can-i-do branch September 6, 2016 17:13

xilabao mentioned this pull request Jun 21, 2017

support what-can-i-do in kubernetes kubernetes/kubernetes#47834

Closed

add what-can-i-do endpoint #8675

add what-can-i-do endpoint #8675

Uh oh!

Conversation

deads2k commented Apr 28, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

smarterclayton commented Apr 28, 2016

PertinentPermissions and PersonalPertinentPermissions?

Uh oh!

deads2k commented Apr 28, 2016

Uh oh!

smarterclayton commented Apr 28, 2016

Uh oh!

deads2k commented Apr 29, 2016

Uh oh!

deads2k commented Apr 29, 2016

Uh oh!

deads2k commented Apr 29, 2016

Uh oh!

pweil- commented Apr 29, 2016

Uh oh!

openshift-bot commented May 2, 2016

Uh oh!

openshift-bot commented May 2, 2016

Uh oh!

deads2k commented May 2, 2016

Uh oh!

jwforres commented May 2, 2016

Uh oh!

smarterclayton commented May 2, 2016

Uh oh!

deads2k commented May 2, 2016

Uh oh!

sgallagher commented May 3, 2016

Uh oh!

smarterclayton commented May 3, 2016

Uh oh!

deads2k commented May 3, 2016

Uh oh!

sgallagher commented May 3, 2016

Uh oh!

deads2k commented May 3, 2016

Uh oh!

openshift-bot commented May 3, 2016 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deads2k commented May 3, 2016

Uh oh!

liggitt commented May 3, 2016

Uh oh!

deads2k commented May 3, 2016

Uh oh!

openshift-bot commented May 3, 2016

Uh oh!

Uh oh!

deads2k commented Apr 28, 2016 •

edited

Loading

openshift-bot commented May 3, 2016 •

edited

Loading