Skip to content

Commit bcd7110

Browse files
author
edge-katanomi-app2[bot]
committed
📚 Sync docs from alaudadevops/connectors-operator on b6f1cfc70647caed1b74ce8884887ca18ec0330b
Source: Docs/approval tech desgin (#532) Author: chengjingtao Ref: refs/heads/main Commit: b6f1cfc70647caed1b74ce8884887ca18ec0330b This commit automatically syncs documentation changes from the source-docs repository. 🔗 View source commit: https://github.com/alaudadevops/connectors-operator/commit/b6f1cfc70647caed1b74ce8884887ca18ec0330b 🤖 Synced on 2026-02-12 05:45:44 UTC
1 parent f4dfc2d commit bcd7110

3 files changed

Lines changed: 1174 additions & 3 deletions

File tree

‎.github/SYNC_INFO.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# Documentation Sync Information
22

3-
- **Last synced**: 2026-02-10 09:54:29 UTC
3+
- **Last synced**: 2026-02-12 05:45:44 UTC
44
- **Source repository**: alaudadevops/connectors-operator
5-
- **Source commit**: [d57e272d4c0b22639843c60015a108091ee215ef](https://github.com/alaudadevops/connectors-operator/commit/d57e272d4c0b22639843c60015a108091ee215ef)
5+
- **Source commit**: [b6f1cfc70647caed1b74ce8884887ca18ec0330b](https://github.com/alaudadevops/connectors-operator/commit/b6f1cfc70647caed1b74ce8884887ca18ec0330b)
66
- **Triggered by**: edge-katanomi-app2[bot]
7-
- **Workflow run**: [#95](https://github.com/alaudadevops/connectors-operator/actions/runs/21860079377)
7+
- **Workflow run**: [#96](https://github.com/alaudadevops/connectors-operator/actions/runs/21935142117)
88

99
## Files synced:
1010
- docs/

‎docs/en/design/connectors-approval/connectors-apis-permissions.tech-design.md‎

Lines changed: 288 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,288 @@
1+
# Connectors 权限拆分
2+
3+
## 目标
4+
5+
拆分 Connectors 的权限， 配合流水线，以手动赋权的方式能够完成 用户申请，审批， 使用 Connectors 部署到生产环境的流水线。手动赋权能够确保最小粒度的权限控制
6+
7+
- 拆分 Connectors 的权限
8+
- 手动赋予 SA 最小粒度的权限
9+
10+
## 拆分 Connectors 的权限
11+
12+
| Resource | Action | Description |
13+
| --------------- | ---------------------------------- | ----------------------------------- |
14+
| connectors | Get/List/Watch/Patch/Update/Delete | Connector 的权限 |
15+
| connectors/apis | Get/Update/Delete | 操作 Connector 指向的工具资源的权限 |
16+
17+
## Role & RoleBinding
18+
19+
### 使用 ResourceNames 方式绑定权限
20+
21+
**Role**
22+
23+
- Resource: `connectors/apis/{context-resource-name}`
24+
- resourceNames: `{connector-name}`
25+
- verbs: `{verb}`
26+
- context-resource-name: 资源的上下文名称， `{api-version}/{resources}/{resource-name}` 例如： tekton.dev/v1/namespaces/default/pipelineruns/pr-demo-01
27+
28+
**RoleBinding**
29+
30+
约束 ServiceAccount 仅能在如下上下文中访问资源
31+
32+
- 特定 Namespace 的 特定 PipelineRun
33+
- 特定 Namespace 的 特定 Connector
34+
- 特定 Verb
35+
36+
**示例**
37+
38+
39+
``` bash
40+
41+
export NS=default
42+
export PR_NAME=pr-demo-01
43+
44+
# 创建 指定 Connector 和 PipelineRun 的 Role
45+
46+
cat << EOF | kubectl apply -n $NS -f -
47+
kind: Role
48+
apiVersion: rbac.authorization.k8s.io/v1
49+
metadata:
50+
name: connectors-apis-reader-for-$PR_NAME
51+
rules:
52+
- apiGroups: [ "connectors.alauda.io" ]
53+
resources: [ "connectors/apis/tekton.dev/v1/pipelineruns/$PR_NAME" ]
54+
resourceNames: [ "prod-harbor" ]
55+
verbs: [ "get" ]
56+
EOF
57+
58+
# 创建 RoleBinding 绑定到指定的 ServiceAccount
59+
60+
cat << EOF | kubectl apply -n $NS -f -
61+
kind: RoleBinding
62+
apiVersion: rbac.authorization.k8s.io/v1
63+
metadata:
64+
name: bind-connectors-apis-reader-for-$PR_NAME
65+
subjects:
66+
- kind: ServiceAccount
67+
name: pipeline-sa
68+
namespace: $NS
69+
roleRef:
70+
kind: Role
71+
name: connectors-apis-reader-for-$PR_NAME
72+
apiGroup: rbac.authorization.k8s.io
73+
EOF
74+
75+
# 允许
76+
kubectl auth can-i update connectors/prod-harbor --subresource apis/tekton.dev/v1/pipelineruns/$PR_NAME --as=system:serviceaccount:$NS:pipeline-sa
77+
78+
# 拒绝
79+
kubectl auth can-i update connectors/prod-harbor --subresource apis/tekton.dev/v1/pipelineruns/$PR_NAME-changed --as=system:serviceaccount:$NS:pipeline-sa
80+
81+
```
82+
83+
### 使用 Non-ResourceURLs 方式绑定权限
84+
85+
Non-ResourceURLs 必须使用 ClusterRole 和 ClusterRoleBinding 进行绑定
86+
87+
**ClusterRole**
88+
89+
- nonResourceURLs: `/connectors/apis/{connector-ns-name}/context/{context-resource-name}/path/{api-path}`
90+
- verbs: `{verb}`
91+
92+
**ClusterRoleBinding**
93+
94+
约束 ServiceAccount 仅能在如下上下文中访问资源
95+
96+
- 特定 Namespace 的 特定 Connector
97+
- 特定 Namespace 的 特定 PipelineRun
98+
- 特定 Verb
99+
- 特定 Path 的 请求
100+
101+
**示例**
102+
103+
``` bash
104+
export NS=default-2
105+
export PR_NAME=pr-demo-02
106+
export CONNECTOR_NAME=prod-harbor
107+
108+
kubectl create ns $NS
109+
kubectl create sa pipeline-sa -n $NS
110+
111+
cat << EOF | kubectl apply -n $NS -f -
112+
kind: ClusterRole
113+
apiVersion: rbac.authorization.k8s.io/v1
114+
metadata:
115+
name: connectors-apis-non-resourceurls-writer-for-$PR_NAME
116+
rules:
117+
- nonResourceURLs: ["/connectors/apis/${NS}/${CONNECTOR_NAME}/context/tekton.dev/v1/pipelineruns/$PR_NAME/path/projects/*"]
118+
verbs: ["update"]
119+
EOF
120+
121+
cat << EOF | kubectl apply -n $NS -f -
122+
kind: ClusterRoleBinding
123+
apiVersion: rbac.authorization.k8s.io/v1
124+
metadata:
125+
name: bind-connectors-apis-writer-for-$PR_NAME
126+
subjects:
127+
- kind: ServiceAccount
128+
name: pipeline-sa
129+
namespace: $NS
130+
roleRef:
131+
kind: ClusterRole
132+
name: connectors-apis-non-resourceurls-writer-for-$PR_NAME
133+
apiGroup: rbac.authorization.k8s.io
134+
EOF
135+
136+
# 允许
137+
kubectl auth can-i update /connectors/apis/${NS}/${CONNECTOR_NAME}/context/tekton.dev/v1/pipelineruns/$PR_NAME/path/projects/abc --as=system:serviceaccount:$NS:pipeline-sa
138+
139+
# 拒绝
140+
kubectl auth can-i update /connectors/apis/${NS}/${CONNECTOR_NAME}/context/tekton.dev/v1/pipelineruns/$PR_NAME/path/repository/abc --as=system:serviceaccount:$NS:pipeline-sa
141+
```
142+
143+
### 讨论
144+
145+
ClusterRole & ClusterRoleBinding 方式虽然比较灵活和强大， 但在资源管理上存在一些局限:
146+
147+
- NS 内的审批授权人员需要 创建或者管理 Cluster 级别的资源，这是不太合理的。
148+
- NS 维度的资源管理不方便。
149+
150+
使用 ResourceNames 方式绑定权限，无法做到 Path 级别的权限控制， 但按照 Path 级别的控制用户决策更为复杂，想要精细的控制某次审批允许的 API 范围，并不是容易的事情. 适用的场景尚不明确。
151+
152+
综合考虑， 使用 ResourceNames 方式绑定权限， 作为默认的权限绑定方式。 满足大部分的使用场景。
153+
154+
## 设计
155+
156+
### 功能开关
157+
158+
- ``enable-connectors-apis-permissions``: 默认关闭
159+
160+
### Role & RoleBinding 手动创建
161+
162+
- resource: `connectors/apis/{context-resource-name}`
163+
- resourceNames: `{connector-name}`
164+
- verbs: `{verb}`
165+
- `{context-resource-name}`: 资源的上下文名称， `{api-version}/{resource-kind}/{resource-namespace}/{resource-name}` 例如： tekton.dev/v1/pipelineruns/default/pr-demo-01
166+
167+
> PipelineRun 的 NS 名称 和 Connector 所在的 NS 名称 可能不一致。
168+
169+
**临时授权**
170+
171+
``` yaml
172+
kind: Role
173+
apiVersion: rbac.authorization.k8s.io/v1
174+
metadata:
175+
name: connectors-apis-reader-for-$PR_NAME
176+
namespace: devops
177+
rules:
178+
- apiGroups: [ "connectors.alauda.io" ]
179+
resources: [ "connectors/apis/tekton.dev/v1/pipelineruns/devops-ns1/$PR_NAME" ]
180+
resourceNames: [ "prod-harbor" ]
181+
verbs: [ "update", "delete" ]
182+
---
183+
kind: RoleBinding
184+
apiVersion: rbac.authorization.k8s.io/v1
185+
```
186+
187+
**只读授权**
188+
``` yaml
189+
kind: Role
190+
apiVersion: rbac.authorization.k8s.io/v1
191+
metadata:
192+
name: connectors-apis-reader
193+
rules:
194+
- apiGroups: [ "connectors.alauda.io" ]
195+
resources: [ "connectors/apis" ]
196+
resourceNames: [ "*" ]
197+
verbs: [ "get" ]
198+
---
199+
kind: RoleBinding
200+
apiVersion: rbac.authorization.k8s.io/v1
201+
```
202+
203+
验证
204+
205+
``` bash
206+
207+
# 允许
208+
kubectl auth can-i update connectors/prod-harbor --subresource apis --as=system:serviceaccount:$NS:pipeline-sa -n $NS
209+
210+
# 允许
211+
kubectl auth can-i update connectors/prod-harbor --subresource apis/tekton.dev/v1/pipelineruns/$PR_NAME --as=system:serviceaccount:$NS:pipeline-sa -n $NS
212+
213+
# 拒绝
214+
kubectl auth can-i update connectors/prod-harbor --subresource apis/tekton.dev/v1/pipelineruns/$PR_NAME-changed --as=system:serviceaccount:$NS:pipeline-sa -n $NS
215+
216+
```
217+
218+
### API 请求权限配置
219+
220+
:::info
221+
222+
git clone 会发送 post 请求。 POST https://gitlab-ce.alauda.cn/devops/katanomi.git/git-upload-pack
223+
224+
需要针对不同的工具类型，提供配置方案，能够配置工具的 API 请求与 `Role Rules Verb` 的映射关系。 无配置时，默认按照请求 http method 来区分.
225+
226+
- Get/Head/Option -> read
227+
- Put/Post -> write
228+
- Delete -> delete
229+
230+
:::
231+
232+
例如： 配置 git connectorclass, 将 git 所有的 GET 和 POST /git-upload-pack 按照 read 操作来对待。
233+
234+
``` yaml
235+
kind: ConnectorClass
236+
metadata:
237+
name: git
238+
spec:
239+
api:
240+
permissions:
241+
rego: |
242+
package permissions
243+
result = {
244+
"verb": "read"
245+
}
246+
```
247+
248+
### 改动
249+
250+
- Connectors API Filter 增加 对 connectors/apis SubResources 权限的验证
251+
- Connectors Proxy (正代和反代) 增加 对 connectors/apis SubResources 权限的验证
252+
253+
### 默认角色权限
254+
255+
**方案1**
256+
257+
- connector view 角色： 仅允许 get/list/watch connectors 资源， 以及 /connectors/apis/*:get 权限
258+
- connector admin 角色： 允许 connectors 资源的所有操作， 以及 /connectors/apis/*:* 权限
259+
260+
**方案2**
261+
262+
- connector view 和 admin 角色： 仅允许 get/list/watch connectors 资源， 以及 /connectors/apis/*:get 权限
263+
264+
推荐: 方案2
265+
266+
具备平台 connector admin 角色，并不意味着对工具的数据具有 admin 权限。这是跨信任边界的。
267+
对于工具上的敏感操作，应该是即时授权的使用机制。 避免 **权限的横向移动**。`k8s connector admin -> 工具 admin`
268+
269+
**Cluster Connector**
270+
271+
| 角色名称 | 权限 |
272+
| -------------------------------------- | -------------------------------------------------- |
273+
| cpaas:connectors-cluster:cluster:view | connectors:get/list/watch , /connectors/apis:get |
274+
| cpaas:connectors-cluster:cluster:admin | connectors:* , /connectors/apis:get |
275+
276+
**Project Connector**
277+
278+
| 角色名称 | 权限 |
279+
| ----------------------------------------- | -------------------------------------------------- |
280+
| cpaas:connectors-project:project-ns:view | connectors:get/list/watch , /connectors/apis:get |
281+
| cpaas:connectors-project:project-ns:admin | connectors:* , /connectors/apis:get |
282+
283+
**Namespace Connector**
284+
285+
| 角色名称 | 权限 |
286+
| --------------------------------------------- | -------------------------------------------------- |
287+
| cpaas:connectors-namespaced:business-ns:view | connectors:get/list/watch , /connectors/apis:get |
288+
| cpaas:connectors-namespaced:business-ns:admin | connectors:* , /connectors/apis:get |

0 commit comments

Comments
 (0)