Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Fleet][Endpoint][RBAC V2] Update fleet router and config to allow API access via RBAC controls #145361

Merged
merged 68 commits into from
Dec 14, 2022
Merged

[Fleet][Endpoint][RBAC V2] Update fleet router and config to allow API access via RBAC controls #145361

merged 68 commits into from
Dec 14, 2022

Commits on Nov 29, 2022

  1. update fleet router config to allow route access independent of tags 

    fixes elastic/security-team/issues/4926
ref elastic/security-team/issues/5539
    @ashokaditya
    ashokaditya committed Nov 29, 2022
    Configuration menu
    Copy the full SHA
    7aa1a1a View commit details
    Browse the repository at this point in the history

Commits on Nov 30, 2022

  1. update fleet router config to allow route access independent of tags 

    fixes elastic/security-team/issues/4926
ref elastic/security-team/issues/5539
    @ashokaditya
    ashokaditya committed Nov 30, 2022
    Configuration menu
    Copy the full SHA
    e8001ad View commit details
    Browse the repository at this point in the history

  2. Merge remote-tracking branch 'ashokaditya/task/olm-policy-list-api-rb… 

    …ac-4926' into pr/ash/task/olm-policy-list-api-rbac-4926

# Conflicts:
#	x-pack/plugins/fleet/server/routes/agent_policy/index.ts
#	x-pack/plugins/fleet/server/routes/epm/index.ts
#	x-pack/plugins/fleet/server/routes/package_policy/index.ts
#	x-pack/plugins/fleet/server/routes/security.ts
#	x-pack/plugins/fleet/server/services/package_policy.ts
    @paul-tavares
    paul-tavares committed Nov 30, 2022
    Configuration menu
    Copy the full SHA
    48ec615 View commit details
    Browse the repository at this point in the history

Commits on Dec 5, 2022

  1. update fleet router config to allow route access independent of tags 

    fixes elastic/security-team/issues/4926
ref elastic/security-team/issues/5539
    @ashokaditya
    ashokaditya committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    927ede7 View commit details
    Browse the repository at this point in the history

  2. rename

    @ashokaditya
    ashokaditya committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    9f38ca4 View commit details
    Browse the repository at this point in the history

  3. simplify logic

    @ashokaditya
    ashokaditya committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    10316bf View commit details
    Browse the repository at this point in the history

  4. cleanup

    @ashokaditya
    ashokaditya committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    1898a6e View commit details
    Browse the repository at this point in the history

  5. fix tests

    @ashokaditya
    ashokaditya committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    eecb740 View commit details
    Browse the repository at this point in the history

  6. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 5, 2022
    Configuration menu
    Copy the full SHA
    3dd26ca View commit details
    Browse the repository at this point in the history

  7. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 5, 2022
    Configuration menu
    Copy the full SHA
    70eb960 View commit details
    Browse the repository at this point in the history

  8. Merge remote-tracking branch 'ashokaditya/task/olm-policy-list-api-rb… 

    …ac-4926' into pr/ash/task/olm-policy-list-api-rbac-4926

# Conflicts:
#	x-pack/plugins/fleet/server/routes/agent_policy/index.ts
#	x-pack/plugins/fleet/server/routes/epm/index.ts
#	x-pack/plugins/fleet/server/routes/package_policy/index.ts
#	x-pack/plugins/fleet/server/routes/security.test.ts
#	x-pack/plugins/fleet/server/routes/security.ts
#	x-pack/plugins/fleet/server/services/package_policy.ts
    @paul-tavares
    paul-tavares committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    4e8a4d6 View commit details
    Browse the repository at this point in the history

  9. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 5, 2022
    Configuration menu
    Copy the full SHA
    50d2547 View commit details
    Browse the repository at this point in the history

  10. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 5, 2022
    Configuration menu
    Copy the full SHA
    608a025 View commit details
    Browse the repository at this point in the history

  11. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 5, 2022
    Configuration menu
    Copy the full SHA
    69bafc4 View commit details
    Browse the repository at this point in the history

  12. Retrieve correct SO client when Authz are NOT granted via Fleet privi… 

    …leges
    @paul-tavares
    paul-tavares committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    032cda6 View commit details
    Browse the repository at this point in the history

  13. Merge remote-tracking branch 'ashokaditya/task/olm-policy-list-api-rb… 

    …ac-4926' into pr/ash/task/olm-policy-list-api-rbac-4926
    @paul-tavares
    paul-tavares committed Dec 5, 2022
    Configuration menu
    Copy the full SHA
    9f66a3c View commit details
    Browse the repository at this point in the history

Commits on Dec 6, 2022

  1. update types and use calculateRouteAuthz 

    for policy service
    @ashokaditya
    ashokaditya committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    4311cb1 View commit details
    Browse the repository at this point in the history

  2. update authzwrapper to use calculateRouteAuthz

    @ashokaditya
    ashokaditya committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    543f8b6 View commit details
    Browse the repository at this point in the history

  3. Update logic in calculateRouteAuthz() so that each package privileg… 

    …es is checked individually
    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    cc3d358 View commit details
    Browse the repository at this point in the history

  4. Revert changes to agent policy and epm APIs (keeping scope small)

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    e85e3d7 View commit details
    Browse the repository at this point in the history

  5. backout change to epm categories route handler

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    3e1220d View commit details
    Browse the repository at this point in the history

  6. Merge remote-tracking branch 'upstream/main' into pr/ash/task/olm-pol… 

    …icy-list-api-rbac-4926
    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    d498dbd View commit details
    Browse the repository at this point in the history

  7. Refactor package policy routes and Plugin route context to use `calcu… 

    …lateRouteAuthz`
    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    60f3555 View commit details
    Browse the repository at this point in the history

  8. Adjusted package policy service to use calculateRouteAuthz

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    0706c5b View commit details
    Browse the repository at this point in the history

  9. Remove unused code from security.ts

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    1122ba7 View commit details
    Browse the repository at this point in the history

  10. Refactor: re-organized server security module

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    7c32db2 View commit details
    Browse the repository at this point in the history

  11. Move fleet router tests to its own file

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    45d6eca View commit details
    Browse the repository at this point in the history

  12. Fix mocks and security tests

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    4af47dd View commit details
    Browse the repository at this point in the history

  13. add to tests for calculateRouteAuthz()

    @paul-tavares
    paul-tavares committed Dec 6, 2022
    Configuration menu
    Copy the full SHA
    8678da6 View commit details
    Browse the repository at this point in the history

Commits on Dec 7, 2022

  1. Update package policy routes to get SO object from fleet.getSoClient()

    @paul-tavares
    paul-tavares committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    d5cf2a4 View commit details
    Browse the repository at this point in the history

  2. unify logic for gating access

    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    cd6820e View commit details
    Browse the repository at this point in the history

  3. fix type check

    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    f871d16 View commit details
    Browse the repository at this point in the history

  4. fix route path pattern match 

    refs 60f3555
    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    946d5fd View commit details
    Browse the repository at this point in the history

  5. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 7, 2022
    Configuration menu
    Copy the full SHA
    f2f22ab View commit details
    Browse the repository at this point in the history

  6. fix mock path after refactor 

    refs 60f3555
    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    5fcc5cb View commit details
    Browse the repository at this point in the history

  7. use main route pattern 

    refs 946d5fd
    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    1e767fa View commit details
    Browse the repository at this point in the history

  8. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 7, 2022
    Configuration menu
    Copy the full SHA
    414c6d7 View commit details
    Browse the repository at this point in the history

  9. parse routePath instead 

    refs 946d5fd
    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    4c99e0a View commit details
    Browse the repository at this point in the history

  10. parse routePath instead 

    refs 946d5fd
    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    4c6340a View commit details
    Browse the repository at this point in the history

  11. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    056dd0c View commit details
    Browse the repository at this point in the history

  12. limit access to requested packages

    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    1010911 View commit details
    Browse the repository at this point in the history

  13. limit access to data based on allowed packages

    @ashokaditya
    ashokaditya committed Dec 7, 2022
    Configuration menu
    Copy the full SHA
    283cbae View commit details
    Browse the repository at this point in the history

Commits on Dec 8, 2022

  1. package specific list results - part 2

    @ashokaditya
    ashokaditya committed Dec 8, 2022
    Configuration menu
    Copy the full SHA
    c21450a View commit details
    Browse the repository at this point in the history

  2. Merge remote-tracking branch 'ashokaditya/task/olm-policy-list-api-rb… 

    …ac-4926' into pr/ash/task/olm-policy-list-api-rbac-4926

# Conflicts:
#	x-pack/plugins/fleet/server/services/security/route_required_authz.ts
    @paul-tavares
    paul-tavares committed Dec 8, 2022
    Configuration menu
    Copy the full SHA
    adb2e51 View commit details
    Browse the repository at this point in the history

  3. Update error message for Update package policy handler

    @paul-tavares
    paul-tavares committed Dec 8, 2022
    Configuration menu
    Copy the full SHA
    6a11eca View commit details
    Browse the repository at this point in the history

  4. Re-implement package policy api handlers data validation against allo… 

    …wed package names
    @paul-tavares
    paul-tavares committed Dec 8, 2022
    Configuration menu
    Copy the full SHA
    959a0f1 View commit details
    Browse the repository at this point in the history

  5. add shouldHandlePostAuthRequest() check back into fleet router midd… 

    …leware
    @paul-tavares
    paul-tavares committed Dec 8, 2022
    Configuration menu
    Copy the full SHA
    4bd3933 View commit details
    Browse the repository at this point in the history

  6. Add check for kibana security enabled to route handler wrapper

    @paul-tavares
    paul-tavares committed Dec 8, 2022
    Configuration menu
    Copy the full SHA
    051b2a2 View commit details
    Browse the repository at this point in the history

Commits on Dec 9, 2022

  1. Merge remote-tracking branch 'upstream/main' into pr/ash/task/olm-pol… 

    …icy-list-api-rbac-4926
    @paul-tavares
    paul-tavares committed Dec 9, 2022
    Configuration menu
    Copy the full SHA
    ed0f650 View commit details
    Browse the repository at this point in the history

Commits on Dec 10, 2022

  1. Add supertest logger for better messages

    @paul-tavares
    paul-tavares committed Dec 10, 2022
    Configuration menu
    Copy the full SHA
    b659972 View commit details
    Browse the repository at this point in the history

Commits on Dec 11, 2022

  1. Add supertest middleware in bulk_upgrade tests

    @paul-tavares
    paul-tavares committed Dec 11, 2022
    Configuration menu
    Copy the full SHA
    0a34ae6 View commit details
    Browse the repository at this point in the history

  2. Trying again: code to capture failing test API response body

    @paul-tavares
    paul-tavares committed Dec 11, 2022
    Configuration menu
    Copy the full SHA
    f98858c View commit details
    Browse the repository at this point in the history

Commits on Dec 12, 2022

  1. remove redundant registerOnPostAuth

    @ashokaditya
    ashokaditya committed Dec 12, 2022
    Configuration menu
    Copy the full SHA
    0d31e32 View commit details
    Browse the repository at this point in the history

  2. update epm bulk_upgrade FTR tests

    @ashokaditya
    ashokaditya committed Dec 12, 2022
    Configuration menu
    Copy the full SHA
    c347c0f View commit details
    Browse the repository at this point in the history

  3. log router access denied

    @ashokaditya
    ashokaditya committed Dec 12, 2022
    Configuration menu
    Copy the full SHA
    1b76cdd View commit details
    Browse the repository at this point in the history

  4. cleanup 

    refs 959a0f1
refs b659972
refs 0a34ae6
refs f98858c
    @ashokaditya
    ashokaditya committed Dec 12, 2022
    Configuration menu
    Copy the full SHA
    972e8d5 View commit details
    Browse the repository at this point in the history

  5. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 12, 2022
    Configuration menu
    Copy the full SHA
    60fa9e3 View commit details
    Browse the repository at this point in the history

Commits on Dec 13, 2022

  1. use internalSoClient 

    review comments (@nchaulet, @paul-tavares)
    @ashokaditya
    ashokaditya committed Dec 13, 2022
    Configuration menu
    Copy the full SHA
    2886e3d View commit details
    Browse the repository at this point in the history

  2. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 13, 2022
    Configuration menu
    Copy the full SHA
    39cea43 View commit details
    Browse the repository at this point in the history

  3. move internalSoClient out of epm 

    Now that we're using the internal SO client in routes other than `epm` we decided to make it available directly on the fleet context.

review comments (@juliaElastic)
    @ashokaditya
    ashokaditya committed Dec 13, 2022
    Configuration menu
    Copy the full SHA
    a186363 View commit details
    Browse the repository at this point in the history

  4. cleanup logic for limitedToPackages 

    review comments (@juliaElastic)
    @ashokaditya
    ashokaditya committed Dec 13, 2022
    Configuration menu
    Copy the full SHA
    68e366a View commit details
    Browse the repository at this point in the history

  5. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 13, 2022
    Configuration menu
    Copy the full SHA
    1650a0c View commit details
    Browse the repository at this point in the history

  6. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 13, 2022
    Configuration menu
    Copy the full SHA
    2f9c229 View commit details
    Browse the repository at this point in the history

Commits on Dec 14, 2022

  1. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 14, 2022
    Configuration menu
    Copy the full SHA
    3a5c7c0 View commit details
    Browse the repository at this point in the history

  2. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 14, 2022
    Configuration menu
    Copy the full SHA
    442d72a View commit details
    Browse the repository at this point in the history

  3. undo changes to api/fleet/check-permissions 

    refs eecb740
    @ashokaditya
    ashokaditya committed Dec 14, 2022
    Configuration menu
    Copy the full SHA
    e04a741 View commit details
    Browse the repository at this point in the history

  4. cleanup 

    refs eecb740
refs e04a741
    @ashokaditya
    ashokaditya committed Dec 14, 2022
    Configuration menu
    Copy the full SHA
    044e166 View commit details
    Browse the repository at this point in the history

  5. Merge branch 'main' into task/olm-policy-list-api-rbac-4926

    @ashokaditya
    ashokaditya authored Dec 14, 2022
    Configuration menu
    Copy the full SHA
    26b2b46 View commit details
    Browse the repository at this point in the history