ROX-11101: Remove deprecated resources#3036
Merged
rhybrillou merged 15 commits intomasterfrom Nov 8, 2022
Merged
Conversation
|
Skipping CI for Draft Pull Request. |
rukletsov
reviewed
Sep 20, 2022
| ) | ||
|
|
||
| var ( | ||
| migration = types.Migration{ |
Member
There was a problem hiding this comment.
You also need to register a migration in init():
func init() {
migrations.MustRegisterMigration(migration)
}
migrator/migrations/m_108_to_m_109_replace_deprecated_resources/migration.go
Outdated
Show resolved
Hide resolved
| return errors.Wrap(err, "unable to unmarshal permission set") | ||
| } | ||
| // Copy the permission set, removing the deprecated resource permissions, and keeping the | ||
| // highest access level between that of deprecated resource and their replacement |
Member
There was a problem hiding this comment.
I think as a security product we should choose lowest (and call this out in the changelog).
Comment on lines
+117
to
+123
| newPermissionSet := &storage.PermissionSet{} | ||
| newPermissionSet.Id = permissions.GetId() | ||
| newPermissionSet.Name = permissions.GetName() | ||
| newPermissionSet.Description = permissions.GetDescription() | ||
| if len(permissions.GetResourceToAccess()) > 0 { | ||
| newPermissionSet.ResourceToAccess = make(map[string]storage.Access) | ||
| } |
Member
There was a problem hiding this comment.
Suggested change
| newPermissionSet := &storage.PermissionSet{} | |
| newPermissionSet.Id = permissions.GetId() | |
| newPermissionSet.Name = permissions.GetName() | |
| newPermissionSet.Description = permissions.GetDescription() | |
| if len(permissions.GetResourceToAccess()) > 0 { | |
| newPermissionSet.ResourceToAccess = make(map[string]storage.Access) | |
| } | |
| newPermissionSet := &storage.PermissionSet{ | |
| Id: permissions.GetId(), | |
| Name: permissions.GetName(), | |
| Description: permissions.GetDescription(), | |
| ResourceToAccess: make(map[string]storage.Access, len(permissions.GetResourceToAccess())), | |
| } |
| writeOpts = gorocksdb.NewDefaultWriteOptions() | ||
| ) | ||
|
|
||
| func propagatePermission(resource string, accessLevel storage.Access, permissions map[string]storage.Access) { |
Member
There was a problem hiding this comment.
Instead of modifying permissions (side effect), let's return updated storage.Access.
Contributor
Author
|
/test all |
|
Images are ready for the commit at efa8528. To use with deploy scripts, first |
3 tasks
1c9c4b1 to
908325c
Compare
Contributor
Author
|
/test all |
Contributor
Author
|
/test all |
2 similar comments
Contributor
Author
|
/test all |
Contributor
Author
|
/test all |
dhaus67
suggested changes
Oct 19, 2022
Contributor
dhaus67
left a comment
There was a problem hiding this comment.
Since we are adding a migration, please add proper test description for which manual steps you have run to ensure that the migration works as expected on a running system (as a shameless plug, you can see #2066 as an example of what we should have there for the manual test steps of a migration).
CHANGELOG.md
Outdated
Comment on lines
+41
to
+51
| ### Deprecated Features | ||
| - ROX-11101: Similar to what was announced in 3.71.0 for ROX-8520, more permissions for permission sets will be grouped for simplification. As a result, the following permissions will be deprecated in favor of a new permission: | ||
| - New permission `Administration` will deprecate the permissions `AllComments, ComplianceRunSchedule, Config, DebugLogs, NetworkGraphConfig, ProbeUpload, ScannerBundle, ScannerDefinitions, SensorUpgradeConfig, ServiceIdentity`. | ||
| - The permission `Compliance` will deprecate the permission `ComplianceRuns`. | ||
| ### Technical Changes | ||
| - ROX-11101: As announced in 3.71.0 (ROX-8520), some permissions for permissionsets are being grouped for simplification. The deprecation process will remove and replace the deprecated permissions with the replacing permission as listed below. The access level granted to the replacing permission will be the lowest of its defined access level if any and the defined access levels for all the permissions it replaces. | ||
| - Permission `Access` deprecates and replaces the permissions `AuthPlugin, AuthProvider, Group, Licenses, User`. | ||
| - Permission `DeploymentExtension` deprecates and replaces the permissions `Indicator, NetworkBaseline, ProcessWhitelist, Risk`. | ||
| - Permission `Integration` deprecates and replaces the permissions `APIToken, BackupPlugins, ImageIntegration, Notifier, SignatureIntegration`. | ||
| - Permission `Image` deprecates and replaces the permission `ImageComponent`. | ||
| - Note: the `Role` permission, previously announced as being grouped under `Access` remains a standalone permission. | ||
|
|
Contributor
There was a problem hiding this comment.
We now have those sections defined, so should merge them with the existing one.
| migrations.MustRegisterMigration(migration) | ||
| } | ||
|
|
||
| func propagatePermission(resource string, accessLevel storage.Access, permissions map[string]storage.Access) storage.Access { |
Contributor
There was a problem hiding this comment.
nit: The naming of this function is a bit confusing to me, we talk about permission but actually determine the new access. Might be relevant to say propagateAccess the least?
Comment on lines
+79
to
+82
| if _, found := permissions[resource]; !found { | ||
| return accessLevel | ||
| } | ||
| oldLevel := permissions[resource] |
Contributor
There was a problem hiding this comment.
Suggested change
| if _, found := permissions[resource]; !found { | |
| return accessLevel | |
| } | |
| oldLevel := permissions[resource] | |
| oldLevel, found := permissions[resource] | |
| if !found { | |
| return accessLevel | |
| } |
Comment on lines
+83
to
+86
| if accessLevel > oldLevel { | ||
| return oldLevel | ||
| } | ||
| return accessLevel |
Contributor
There was a problem hiding this comment.
General question on this: have we decided that this is the way to go? If we keep as-is, this could potentially break existing customer's permission sets after migration.
Say customer has a permission set with write to AuthProvider and read to User, we will have after migration read to Access, which would break his access to AuthProvider (which he seemingly required, since he set it to begin with).
Is this something that we have decided is OK for customers / will there be a special announcement and we expect them to manually change this afterwards?
I might miss context, but haven't found anything in the related slack channel.
Member
There was a problem hiding this comment.
We have no clue, including product. Yann tried to ask product but not much luck. Basically, we have two aggregation options:
- min, which is how it's done now and how I convinced Yann to do it
- max, what Yann had originally.
My thinking is that for a security product it's easier to explain angry customers why we narrowed the permissions.
Contributor
There was a problem hiding this comment.
Hm, I see.
I would have gone for max due to it probably not resulting in directly visible breaking changes (i.e. receiving a support case due to user X not being able to create image integrations), but min is also fine since its a breaking change either way.
My point of emphasis would be to specifically highlight this change, in order for us to not get too many support cases beginning with the next release.
Member
There was a problem hiding this comment.
My point of emphasis would be to specifically highlight this change, in order for us to not get too many support cases beginning with the next release.
This is fair, Daniel.
| return accessLevel | ||
| } | ||
|
|
||
| func migatePermissionSets(db *gorocksdb.DB) error { |
Contributor
There was a problem hiding this comment.
nit: can we be a bit more explicit regarding what exactly we are migrating here? Something such as migrateReplacedResources.
Comment on lines
+109
to
+114
| newResource := resource | ||
| if _, found := replacements[resource]; found { | ||
| newResource = replacements[resource] | ||
| } | ||
| newPermissionSet.ResourceToAccess[newResource] = | ||
| propagatePermission(newResource, accessLevel, newPermissionSet.ResourceToAccess) |
Contributor
There was a problem hiding this comment.
nit: I find the usage of newResource and resource a bit confusing when reading through the function, so maybe reduce the cognitive overhead and just keep resource.
Suggested change
| newResource := resource | |
| if _, found := replacements[resource]; found { | |
| newResource = replacements[resource] | |
| } | |
| newPermissionSet.ResourceToAccess[newResource] = | |
| propagatePermission(newResource, accessLevel, newPermissionSet.ResourceToAccess) | |
| if _, found := replacements[resource]; found { | |
| resource = replacements[resource] | |
| } | |
| newPermissionSet.ResourceToAccess[resource] = | |
| propagatePermission(resource, accessLevel, newPermissionSet.ResourceToAccess) |
| suite.NoError(err) | ||
|
|
||
| key := rocksdbmigration.GetPrefixedKey(prefix, []byte(initial.GetId())) | ||
| suite.NoError(suite.db.Put(writeOpts, key, data)) |
Contributor
There was a problem hiding this comment.
nit: we might want to stop doing anything afterwards if an error occurred here.
Suggested change
| suite.NoError(suite.db.Put(writeOpts, key, data)) | |
| suite.Require().NoError(suite.db.Put(writeOpts, key, data)) |
| RocksDB: suite.db.DB, | ||
| } | ||
|
|
||
| suite.NoError(migration.Run(dbs)) |
Contributor
There was a problem hiding this comment.
nit: we might want to stop doing anything afterwards if an error occurred here.
Suggested change
| suite.NoError(migration.Run(dbs)) | |
| suite.Require().NoError(migration.Run(dbs)) |
Comment on lines
+530
to
+531
| var expectedPSsAfterMigration []*storage.PermissionSet | ||
| expectedPSsAfterMigration = append(expectedPSsAfterMigration, MigratedPermissionSets...) |
Contributor
There was a problem hiding this comment.
why not just expectedPSsAfterMigration := MigratedPermissionSets ?
rukletsov
approved these changes
Oct 27, 2022
Member
rukletsov
left a comment
There was a problem hiding this comment.
Looks good to me modulo comments from Daniel and a pending manual test.
CHANGELOG.md
Outdated
| - Permission `DeploymentExtension` deprecates and replaces the permissions `Indicator, NetworkBaseline, ProcessWhitelist, Risk`. | ||
| - Permission `Integration` deprecates and replaces the permissions `APIToken, BackupPlugins, ImageIntegration, Notifier, SignatureIntegration`. | ||
| - Permission `Image` deprecates and replaces the permission `ImageComponent`. | ||
| - Note: the `Role` permission, previously announced as being grouped under `Access` remains a standalone permission. |
Member
There was a problem hiding this comment.
Suggested change
| - Note: the `Role` permission, previously announced as being grouped under `Access` remains a standalone permission. | |
| - Note: the `Role` permission, previously announced as being grouped under `Access` remains a standalone permission for now and will be grouped with `Access` in the future. |
CHANGELOG.md
Outdated
| - The service account "central", which is used by the central deployment, will now include `get and list` access to the pod resource in the namespace | ||
| where central is deployed to. This fixes an issue when generating diagnostic bundles to now correctly include all logs within the namespace of central. | ||
|
|
||
| ### Removed Features |
Member
There was a problem hiding this comment.
This section should be merged with the same one above.
CHANGELOG.md
Outdated
| - New permission `Administration` will deprecate the permissions `AllComments, ComplianceRunSchedule, Config, DebugLogs, NetworkGraphConfig, ProbeUpload, ScannerBundle, ScannerDefinitions, SensorUpgradeConfig, ServiceIdentity`. | ||
| - The permission `Compliance` will deprecate the permission `ComplianceRuns`. | ||
| ### Technical Changes | ||
| - ROX-11101: As announced in 3.71.0 (ROX-8520), some permissions for permissionsets are being grouped for simplification. The deprecation process will remove and replace the deprecated permissions with the replacing permission as listed below. The access level granted to the replacing permission will be the lowest of its defined access level if any and the defined access levels for all the permissions it replaces. |
Member
There was a problem hiding this comment.
Suggested change
| - ROX-11101: As announced in 3.71.0 (ROX-8520), some permissions for permissionsets are being grouped for simplification. The deprecation process will remove and replace the deprecated permissions with the replacing permission as listed below. The access level granted to the replacing permission will be the lowest of its defined access level if any and the defined access levels for all the permissions it replaces. | |
| - ROX-11101: As announced in 3.71.0 (ROX-8520), some permissions for permission sets are being grouped for simplification. The deprecation process will remove and replace the deprecated permissions with the replacing permission as listed below. The access level granted to the replacing permission will be the lowest among all access levels of the replaced permissions. |
Comment on lines
+83
to
+86
| if accessLevel > oldLevel { | ||
| return oldLevel | ||
| } | ||
| return accessLevel |
Member
There was a problem hiding this comment.
We have no clue, including product. Yann tried to ask product but not much luck. Basically, we have two aggregation options:
- min, which is how it's done now and how I convinced Yann to do it
- max, what Yann had originally.
My thinking is that for a security product it's easier to explain angry customers why we narrowed the permissions.
This was referenced Oct 27, 2022
md2119
reviewed
Oct 31, 2022
CHANGELOG.md
Outdated
| - The service account "central", which is used by the central deployment, will now include `get and list` access to the pod resource in the namespace | ||
| where central is deployed to. This fixes an issue when generating diagnostic bundles to now correctly include all logs within the namespace of central. | ||
|
|
||
| ### Removed Features |
CHANGELOG.md
Outdated
|
|
||
| ### Removed Features | ||
| ### Deprecated Features | ||
| - ROX-11101: Similar to what was announced in 3.71.0 for ROX-8520, more permissions for permission sets will be grouped for simplification. As a result, the following permissions will be deprecated in favor of a new permission: |
Contributor
There was a problem hiding this comment.
Similar to what was announced in 3.71.0 for ROX-8520, more permissions for permission sets will be grouped for simplification. is confusing.
Maybe something like As first announced in 3.71.0, we continue to simplify access control management by grouping some permissions in permission sets. As a results...
CHANGELOG.md
Outdated
| - The permission `Compliance` will deprecate the permission `ComplianceRuns`. | ||
| ### Technical Changes | ||
| - ROX-11101: As announced in 3.71.0 (ROX-8520), some permissions for permissionsets are being grouped for simplification. The deprecation process will remove and replace the deprecated permissions with the replacing permission as listed below. The access level granted to the replacing permission will be the lowest of its defined access level if any and the defined access levels for all the permissions it replaces. | ||
| - Permission `Access` deprecates and replaces the permissions `AuthPlugin, AuthProvider, Group, Licenses, User`. |
Contributor
There was a problem hiding this comment.
deprecates and replaces seems not right since in the deprecation phase we continue to support the feature that is being deprecated. Although this announcement sounds like a technical change, I feel this should go into Removed Features section since we are removing some permission and adding new ones.
Contributor
|
Are we planning a 1 (shorter) or 2 (standard) release cycle deprecation? |
md2119
reviewed
Oct 31, 2022
CHANGELOG.md
Outdated
| - The permission `Compliance` will deprecate the permission `ComplianceRuns`. | ||
| ### Technical Changes | ||
| - ROX-11101: As announced in 3.71.0 (ROX-8520), some permissions for permissionsets are being grouped for simplification. The deprecation process will remove and replace the deprecated permissions with the replacing permission as listed below. The access level granted to the replacing permission will be the lowest of its defined access level if any and the defined access levels for all the permissions it replaces. | ||
| - Permission `Access` deprecates and replaces the permissions `AuthPlugin, AuthProvider, Group, Licenses, User`. |
Contributor
There was a problem hiding this comment.
Seems like AuthPlugin was already removed in 3.71.0 and is not relevant to this initiative.
md2119
reviewed
Oct 31, 2022
Comment on lines
+102
to
+107
| newPermissionSet := &storage.PermissionSet{ | ||
| Id: permissions.GetId(), | ||
| Name: permissions.GetName(), | ||
| Description: permissions.GetDescription(), | ||
| ResourceToAccess: make(map[string]storage.Access, len(permissions.GetResourceToAccess())), | ||
| } |
Contributor
There was a problem hiding this comment.
Suggested change
| newPermissionSet := &storage.PermissionSet{ | |
| Id: permissions.GetId(), | |
| Name: permissions.GetName(), | |
| Description: permissions.GetDescription(), | |
| ResourceToAccess: make(map[string]storage.Access, len(permissions.GetResourceToAccess())), | |
| } | |
| newPermissionSet := permissions.Clone() |
dd6f645 to
59a9f08
Compare
Contributor
Author
|
/retest |
59a9f08 to
e0b6d8a
Compare
…g permission sets
…ermissions from the migration.
…or that group yet.
e0b6d8a to
4ba8aa3
Compare
Contributor
Author
|
/retest |
dhaus67
approved these changes
Nov 7, 2022
md2119
reviewed
Nov 8, 2022
| - ROX-13034: Central reaches out to scanner `scanner.<namespace>.svc` now to respect OpenShift's `NO_PROXY` configuration. | ||
|
|
||
| ### Deprecated Features | ||
| - ROX-11101: As first announced in 3.71.0 for ROX-8250, we continue to simplify access control management by grouping some permissions in permission sets. As a result: |
md2119
approved these changes
Nov 8, 2022
Contributor
md2119
left a comment
There was a problem hiding this comment.
"Simplicity is a prerequisite for reliability." - Edsger Dijkstra
vikin91
added a commit
that referenced
this pull request
Nov 25, 2022
7ffc6be ROX-13368: Skip failing nongroovy tests on PG (#3721) bbdd7a0 Bump github.com/gofrs/uuid from 4.3.0+incompatible to 4.3.1+incompatible (#3642) 1f253f2 Bump github.com/google/certificate-transparency-go from 1.1.3 to 1.1.4 (#3543) d434c8d [ROX-13030] : Add delete collection API endpoint and service implementation (#3648) f062c21 Dashrews/ROX-13253 wait for central-db to come back after bounce and allow FATAL connection lost error (#3537) edc1174 CI: Fill the gaps for https://testgrid.k8s.io/ (#3715) 86d7c54 ROX-13231: use passed context when non-postgres (#3540) 9093195 Add less specific type for BE collection response string (#3728) 5abb652 Only enable ROX_OBJECT_COLLECTIONS feature flag during gke-postgres-ui-e2e job (#3727) 4f64cd1 Add centralDBOnly mode in render (#3707) d67bbe5 Dashrews/ROX-13082 UUID searcher and common updates to set allow use of postgres UUID PR 1 of 4 (#3679) 6f829d5 ROX-13259: graphInit called during init time (#3705) f3bc50d ROX-13380: Conditional rendering edges for deployments and namespaces (#3641) 3764476 ROX-12319: implement smoke test step with groovy test filter (#3220) f202fd4 ROX-11826: Disable kernel support package uploads for managed central (#3661) 61f03dc ROX-11101: Remove deprecated resources from central (#3115) e6aa6d7 ROX-11101: Restore Role permission in UI (#3428) 3203e04 ROX-11101: Remove deprecated resources (#3036) a35f41e Bump golang.org/x/sys from 0.1.0 to 0.2.0 (#3733) 4120524 Bump snakeyaml from 1.29 to 1.33 in /qa-tests-backend (#3732) e1785c0 Bump github.com/coreos/go-systemd/v22 from 22.4.0 to 22.5.0 (#3724) 870df4a Bump google.golang.org/api from 0.101.0 to 0.102.0 (#3723) 721454c Generalize User-Agent setup (#3672) 6a11bf0 Bumps collector version to 3.11.x-145-gc345f72f5e (#3736) ec5d343 [ROX-12923] Walk retries - remainder work (#3729) 40f3d43 ROX-13440: Replace ambiguous central with sensor in networkGraph integration test (#3730) 281ed22 Bump groovy-xml from 2.5.18 to 2.5.19 in /qa-tests-backend (#3741) 49d1651 Bump github.com/prometheus/client_golang from 1.13.1 to 1.14.0 (#3742) b5544aa Bump cloud.google.com/go/storage from 1.27.0 to 1.28.0 (#3743) 9c61e53 ensure CVSS is present for istio vulns (#3706) ae29d52 ROX-13452: don't always clobber scoped ctx when non-postgres (#3748) 517bf05 ROX-13261: DryRunUpdate on collection datastore (#3687) baf7654 ROX-13378: Group new resources with deprecated in UI (#3690) 569922f ROX-13421: Enable roxctl netpol generate and add tech-preview messages (#3740) 2465fc5 Dashrews/ROX-13082 UUID generator templates PR 2 of 4 (#3681) c093c68 Bump slack-api-client from 1.20.2 to 1.27.0 in /qa-tests-backend (#3752) 2c860bb Bump ubi8-micro from 8.6 to 8.7 in /operator (#3751) 80eb04c Make deploy.sh and deploy-local.sh pass shellcheck (#3582) 2182b43 Dashrews/ROX-13082 UUID test updates PR 3 of 4 (#3694) 6dc6ca5 [ROX-13403] : Fix node -> topVuln sub resolver bug when node cves is empty (#3689) 1b21361 Move integration tests for page title from general to specific containers (#3675) e1a9f31 Bump google.golang.org/api from 0.102.0 to 0.103.0 (#3773) a05ea31 Bump golang.org/x/crypto from 0.1.0 to 0.2.0 (#3772) 65ddf4f ROX-12824: Add roxctl commands to generate Central DB bundle (#3602) c3f1e2f Remove obsolete authProviders request for Integrations page (#3759) 7ccd54d Dashrews/ROX-13082 UUID protos generated PR 4 of 4 (#3698) 9ab5c8f cleanup image digest utilities (#3764) 187ed44 ROX-11931: Convert junit failure artifacts to Slack attachments (#3438) b5d8790 ROX-13432: leaning up unused code copied/pasted from topology demo (#3750) ab05bfc Refactor collection form page for better composition (#3744) c5562f7 Remove babel devDependencies in ui-components (#3761) 2b90b3a Extract collection form from drawer wrapper layout (#3745) a779fc9 [ROX-12625 + ROX-13032] : Add GetCollectionCount and UpdateCollection endpoints and services (#3749) e77f0da Upgrade cypress 11.0.0 devDependencies in ui (#3760) a3fba94 ROX-13068: Use real data for deployment details (#3688) 4c7d90e ROX-12617: Collection to search query converter (#3683) 3e98aec ROX-13067: fill out port configurations section of deployment details (#3714) a48de36 ROX-12835: Add support for NodeScanV2 to Sensor (#3533) 30c5dc7 ROX-13466: Fix deletion of groups with empty properties (#3756) 5cb2470 Add autocomplete for name selector dropdowns (#3676) b9a75ad ROX-13464 adding flows dropdown in NG (#3763) 3217a67 [ROX-13500] Perform type check for V1 CronJob (#3787) af3790d Remove bulk delete from collections table (#3776) dda123b Add more info in migration log (#3788) 179f0c9 ROX-13502: Remove the circular dependency between cluster datastore init and cscc notifier init (#3790) 029d584 Update SCANNER_VERSION (#3774) cbca57c Bump github.com/ckaznocha/protoc-gen-lint from 0.2.4 to 0.3.0 (#3783) 3613b56 Bump golang.org/x/tools from 0.2.0 to 0.3.0 (#3782) 5fc0a6a Bump github.com/google/go-containerregistry from 0.12.0 to 0.12.1 (#3781) 1d1c687 Bump controller-gen version to 0.10.0 (#3754) c3a5290 Untie documentation link from the product version (#3799) ed822aa use correct package for migration (#3784) 397a0b4 Validate that label keys are valid k8s labels and ensure correct key splitting (#3777) edd1050 Rename variable ScannerGRPCEndpoint to ScannerSlimGRPCEndpoint (#3657) 6662c9f ROX-13378: Access Control page permissions (#3720) b0e73c5 fix Operator reconciliation for external Central DB (#3796) b83bc1f ROX-13505: Fix error log scanning the postgres stat collection (#3795) ca660cb Prevent the collection being edited from displaying in its own embedded list (#3778) 3f7b3fc [ROX-13441][POSTGRES] Propagate context correctly in retries (#3793) e0cbc6f ROX-12839: Update changelog to announce removal of in-product docs (#3805) 696e8bc [ROX-12358] Follow up on vulnerability request proto change (#2851) c4b46d8 Change getCollectionCount endpoint and updateCollection request type 5f2efbc remove make proto-fmt (#3804) 0c75540 Remove os.Std* from roxctl/central (#3758) 25a90de Add ability to view embedded collections in a pop up modal (#3747) 5c1bf81 ROX-13240: fix scanner-slim updates when WebSockets are used (#3704) 1d98577 Add more context to jira notifier logging (#3812) da2fd28 ROX-13031: DryRun Collection API (#3766) 1c418d5 Test data migration code in postgres tests (#3803) ed95b37 Update UI Collection requests for BE compatibiltiy (#3762) 09cc188 ROX-11931: Fix junit-parse install in CI (#3811) d2b01e3 ROX-12814: Disable PolicyFieldsTest on openshift. (#3797) d10ce27 ROX-13345: disable 'missing required registry' aspect on openshift (#3798) 3d22396 Update collector to 3.12 (#3809) 1eb33fb ROX-13347: Modify scope queries to included quoted cluster and nameace names, to allow exact matches instead of erroneous and unintended prefix matches. (#3767) 3811a69 ROX-12621: list collection selectors api (#3806) f6d3f9d Add migration for groups with invalid values (#3789) cc21125 Bugfixes for collection autocomplete (#3816) 7623dec ROX-9350 Use fine-grained host paths for compliance mounts (#2479) b4bf5c2 Fix collector volumeMounts (#3826) 0e9be05 ROX-12953: figure out last 4 versions of sensor automatically (#3611) 459c7ae ROX-12814: Add proper todo for reenabling the test (#3817) 9ee40ff ROX-13523: add isEnabled enum to central db spec (#3815) 535bc72 Replace requestConfig with routeMatcherMap in helper functions for integration tests (#3686) 2b75b61 `gosec` G104: Add `ShouldErr(err)` that returns `err` (#3830) fb1b82f WIP: Introduce nodescan call 35f8a8f WIP: Prepare converter 716144b Moved and renamed fake nodescan tests 4748de7 Introduce real node scanner with conversion functions 5e6d9a8 wip: real scanner 0169868 wip: log results 1438d2c wip: Debug Analyze call b09894c wip: Debug Analyze call 3ceed72 wip: Update and improve debug logs d1669fd Remove copied lib, bump scanner version, add debug 14a3f73 Merge branch 'master' into mm/ROX-12967-real-nodescan fbd0450 Fix style issues 17ccb31 Debug: let both scans finish to see what they return
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The set resources used for access control is being simplified. A number of resources has been deprecated.
The goal here is to get rid of the deprecated resources, both in the database and in the codebase (UI, QA, central, DB). This PR focuses on the database content cleanup. Full PR chain:
#3036
#3115
#3116
#3428
Checklist
- [ ] Determined and documented upgrade steps- [ ] Documented user facing changes (create PR based on openshift/openshift-docs and merge into rhacs-docs)If any of these don't apply, please comment below.
Testing Performed
Added automated tests for the migration.
Manual testing
centralin RocksDB mode.example:
example:
3.72.x-533-g1614bca3ad.110to111happened, and that the database sequence number at the end is at least111.