fix(manager): grant calico-manager access to WAF logs in linseed - #5133
Open
electricjesus wants to merge 1 commit into
Open
fix(manager): grant calico-manager access to WAF logs in linseed#5133electricjesus wants to merge 1 commit into
electricjesus wants to merge 1 commit into
Conversation
The linseed.tigera.io rule lists the flow, DNS and L7 log resources and their multi-cluster variants but never the WAF ones, so the dashboards API, which queries linseed as the calico-manager service account, is refused for the waf collection. Every WAF dashboard card returns accessDenied for every user regardless of that user's own RBAC. Both names are needed: linseed's WAF handler authorizes against waflogs, and its request middleware appends the multi-cluster suffix for cross-cluster queries, which the dashboards API issues by default. EV-6936
electricjesus
added
kind/bug
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Bug fix. The
linseed.tigera.iorule in the manager's ClusterRole lists the flow, DNS and L7 log resources and their multi-cluster variants, but never the WAF ones. The comment directly above that rule says the multi-cluster variants exist "for Linseed to query across multiple clusters for Enterprise Custom Dashboards", so WAF looks like it was simply missed when the collection was added.calico-dashboard-apiruns inside thecalico-managerpod and queries linseed as the manager's ServiceAccount. So every WAF dashboard card returnsaccessDeniedfor every user, whatever RBAC that user holds. There is no user-side workaround, because the missing permission belongs to the manager rather than to the caller.It is also hard to attribute. The dashboards linseed repository maps a linseed 403 onto the same
accessDeniedreply the API returns when the caller is unauthorized, so a gap one hop downstream looks exactly like the user lacking permission. Same-shaped queries against flows, l7 and dns all succeed for the same caller, which is what isolates it.Both resource names are needed. Linseed's WAF handler authorizes against the plain WAF log resource, and its request middleware appends the multi-cluster suffix for cross-cluster queries, which the dashboards API issues by default.
Components affected: manager rendering only. No other component changes.
Testing
go test ./pkg/render/passes with the two matching test expectations updated.Verified on a dev cluster running a v3.24.0-3.0 hashrelease. Granting the manager ServiceAccount
geton the two WAF log resources made all 17 WAF dashboard cards render immediately, with no other change. Before the grant, every one of them returnedaccessDeniedwhile flows, l7 and dns queries succeeded for the same caller.Issues: https://tigera.atlassian.net/browse/EV-6936
Release Note
For PR author
make gen-filesmake gen-versions