Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add manage_slm and read_slm cluster privileges #41607

Merged
merged 4 commits into from
Apr 29, 2019
Merged

Add manage_slm and read_slm cluster privileges #41607

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7ff17d3
Add `manage_slm` and `read_slm` roles
dakrone Apr 24, 2019
04fa410
Add execute to the test
dakrone Apr 26, 2019
38c7b70
Fix ilm -> slm typo in test
dakrone Apr 29, 2019
9cb5c35
Merge remote-tracking branch 'origin/snapshot-lifecycle-management' i…
dakrone Apr 29, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 11 additions & 1 deletion ...src/main/java/org/elasticsearch/xpack/core/security/authz/privilege/ClusterPrivilege.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,13 @@
import org.elasticsearch.common.Strings;
import org.elasticsearch.xpack.core.indexlifecycle.action.GetLifecycleAction;
import org.elasticsearch.xpack.core.indexlifecycle.action.GetStatusAction;
import org.elasticsearch.xpack.core.indexlifecycle.action.StartILMAction;
import org.elasticsearch.xpack.core.indexlifecycle.action.StopILMAction;
import org.elasticsearch.xpack.core.security.action.token.InvalidateTokenAction;
import org.elasticsearch.xpack.core.security.action.token.RefreshTokenAction;
import org.elasticsearch.xpack.core.security.action.user.HasPrivilegesAction;
import org.elasticsearch.xpack.core.security.support.Automatons;
import org.elasticsearch.xpack.core.snapshotlifecycle.action.GetSnapshotLifecycleAction;

import java.util.Collections;
import java.util.HashSet;
Expand Down Expand Up @@ -60,6 +63,9 @@ public final class ClusterPrivilege extends Privilege {
private static final Automaton READ_CCR_AUTOMATON = patterns(ClusterStateAction.NAME, HasPrivilegesAction.NAME);
private static final Automaton MANAGE_ILM_AUTOMATON = patterns("cluster:admin/ilm/*");
private static final Automaton READ_ILM_AUTOMATON = patterns(GetLifecycleAction.NAME, GetStatusAction.NAME);
private static final Automaton MANAGE_SLM_AUTOMATON =
patterns("cluster:admin/slm/*", StartILMAction.NAME, StopILMAction.NAME, GetStatusAction.NAME);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I understand why you can start/stop ILM with manage_slm but it's kind of awkward, huh.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, gotta be able to stop/start it

private static final Automaton READ_SLM_AUTOMATON = patterns(GetSnapshotLifecycleAction.NAME, GetStatusAction.NAME);

public static final ClusterPrivilege NONE = new ClusterPrivilege("none", Automatons.EMPTY);
public static final ClusterPrivilege ALL = new ClusterPrivilege("all", ALL_CLUSTER_AUTOMATON);
Expand Down Expand Up @@ -90,6 +96,8 @@ public final class ClusterPrivilege extends Privilege {
public static final ClusterPrivilege CREATE_SNAPSHOT = new ClusterPrivilege("create_snapshot", CREATE_SNAPSHOT_AUTOMATON);
public static final ClusterPrivilege MANAGE_ILM = new ClusterPrivilege("manage_ilm", MANAGE_ILM_AUTOMATON);
public static final ClusterPrivilege READ_ILM = new ClusterPrivilege("read_ilm", READ_ILM_AUTOMATON);
public static final ClusterPrivilege MANAGE_SLM = new ClusterPrivilege("manage_slm", MANAGE_SLM_AUTOMATON);
public static final ClusterPrivilege READ_SLM = new ClusterPrivilege("read_slm", READ_SLM_AUTOMATON);

public static final Predicate<String> ACTION_MATCHER = ClusterPrivilege.ALL.predicate();

Expand Down Expand Up @@ -118,7 +126,9 @@ public final class ClusterPrivilege extends Privilege {
entry("read_ccr", READ_CCR),
entry("create_snapshot", CREATE_SNAPSHOT),
entry("manage_ilm", MANAGE_ILM),
entry("read_ilm", READ_ILM));
entry("read_ilm", READ_ILM),
entry("manage_slm", MANAGE_SLM),
entry("read_slm", READ_SLM));

private static final ConcurrentHashMap<Set<String>, ClusterPrivilege> CACHE = new ConcurrentHashMap<>();

Expand Down
30 changes: 30 additions & 0 deletions ...e/src/test/java/org/elasticsearch/xpack/core/security/authz/privilege/PrivilegeTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,4 +204,34 @@ public void testIlmPrivileges() {
assertThat(predicate.test("indices:admin/whatever"), is(false));
}
}

public void testSlmPriviledges() {
{
Predicate<String> predicate = ClusterPrivilege.MANAGE_SLM.predicate();
// check cluster actions
assertThat(predicate.test("cluster:admin/slm/delete"), is(true));
assertThat(predicate.test("cluster:admin/slm/put"), is(true));
assertThat(predicate.test("cluster:admin/slm/get"), is(true));
assertThat(predicate.test("cluster:admin/ilm/start"), is(true));
assertThat(predicate.test("cluster:admin/ilm/stop"), is(true));
assertThat(predicate.test("cluster:admin/slm/execute"), is(true));
assertThat(predicate.test("cluster:admin/ilm/operation_mode/get"), is(true));
// check non-slm action
assertThat(predicate.test("cluster:admin/whatever"), is(false));
}

{
Predicate<String> predicate = ClusterPrivilege.READ_SLM.predicate();
// check cluster actions
assertThat(predicate.test("cluster:admin/slm/delete"), is(false));
assertThat(predicate.test("cluster:admin/slm/put"), is(false));
assertThat(predicate.test("cluster:admin/slm/get"), is(true));
assertThat(predicate.test("cluster:admin/ilm/start"), is(false));
assertThat(predicate.test("cluster:admin/ilm/stop"), is(false));
assertThat(predicate.test("cluster:admin/slm/execute"), is(false));
assertThat(predicate.test("cluster:admin/ilm/operation_mode/get"), is(true));
// check non-slm action
assertThat(predicate.test("cluster:admin/whatever"), is(false));
}
}
}