gravitl/netmaker
1
1
Fork 0
mirror of https://github.com/gravitl/netmaker.git synced 2025-09-06 13:14:24 +08:00
Code Issues Projects Releases Packages Wiki Activity

convert network roles to groups, deprecate RAG roles

Browse source
This commit is contained in:
abhishek9686 2024-10-28 16:18:50 +04:00
parent f7b78ccad6
commit 4eacadbb27
10 changed files with 120 additions and 106 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
controllers/hosts.go
View file

@ -253,19 +253,6 @@ func updateHost(w http.ResponseWriter, r *http.Request) {
newHost := newHostData.ConvertAPIHostToNMHost(currHost)
if newHost.Name != currHost.Name {
// update any rag role ids
for _, nodeID := range newHost.Nodes {
node, err := logic.GetNodeByID(nodeID)
if err == nil && node.IsIngressGateway {
role, err := logic.GetRole(models.GetRAGRoleID(node.Network, currHost.ID.String()))
if err == nil {
role.UiName = models.GetRAGRoleName(node.Network, newHost.Name)
logic.UpdateRole(role)
}
}
}
}
logic.UpdateHost(newHost, currHost) // update the in memory struct values
if err = logic.UpsertHost(newHost); err != nil {
logger.Log(0, r.Header.Get("user"), "failed to update a host:", err.Error())

24
logic/gateway.go
View file

@ -188,30 +188,6 @@ func CreateIngressGateway(netid string, nodeid string, ingress models.IngressReq
if err != nil {
return models.Node{}, err
}
// create network role for this gateway
CreateRole(models.UserRolePermissionTemplate{
ID: models.GetRAGRoleID(node.Network, host.ID.String()),
UiName: models.GetRAGRoleName(node.Network, host.Name),
NetworkID: models.NetworkID(node.Network),
Default: true,
NetworkLevelAccess: map[models.RsrcType]map[models.RsrcID]models.RsrcPermissionScope{
models.RemoteAccessGwRsrc: {
models.RsrcID(node.ID.String()): models.RsrcPermissionScope{
Read: true,
VPNaccess: true,
},
},
models.ExtClientsRsrc: {
models.AllExtClientsRsrcID: models.RsrcPermissionScope{
Read: true,
Create: true,
Update: true,
Delete: true,
SelfOnly: true,
},
},
},
})
err = SetNetworkNodesLastModified(netid)
return node, err
}

2
logic/hosts.go
View file

@ -294,7 +294,7 @@ func UpdateHostFromClient(newHost, currHost *models.Host) (sendPeerUpdate bool)
if err == nil && node.IsIngressGateway {
role, err := GetRole(models.GetRAGRoleID(node.Network, currHost.ID.String()))
if err == nil {
role.UiName = models.GetRAGRoleName(node.Network, newHost.Name)
role.Name = models.GetRAGRoleName(node.Network, newHost.Name)
UpdateRole(role)
}
}

5
logic/user_mgmt.go
View file

@ -46,11 +46,16 @@ var IsNetworkRolesValid = func(networkRoles map[models.NetworkID]map[models.User
return nil
}
var MigrateUserRoleAndGroups = func(u models.User) {
}
var UpdateUserGwAccess = func(currentUser, changeUser models.User) {}
var UpdateRole = func(r models.UserRolePermissionTemplate) error { return nil }
var InitialiseRoles = userRolesInit
var IntialiseGroups = func() {}
var DeleteNetworkRoles = func(netID string) {}
var CreateDefaultNetworkRolesAndGroups = func(netID models.NetworkID) {}
var CreateDefaultUserPolicies = func(netID models.NetworkID) {}

1
main.go
View file

@ -103,6 +103,7 @@ func initialize() { // Client Mode Prereq Check
logic.SetJWTSecret()
logic.InitialiseRoles()
logic.IntialiseGroups()
err = serverctl.SetDefaults()
if err != nil {
logger.FatalLog("error setting defaults: ", err.Error())

68
migrate/migrate.go
View file

@ -178,7 +178,10 @@ func updateNodes() {
node.Tags[tagID] = struct{}{}
logic.UpsertNode(&node)
}
host, err := logic.GetHost(node.HostID.String())
if err == nil {
go logic.DeleteRole(models.GetRAGRoleID(node.Network, host.ID.String()), true)
}
}
if node.IsEgressGateway {
egressRanges, update := removeInterGw(node.EgressGatewayRanges)
@ -356,42 +359,8 @@ func syncUsers() {
// create default network user roles for existing networks
if servercfg.IsPro {
networks, _ := logic.GetNetworks()
nodes, err := logic.GetAllNodes()
if err == nil {
for _, netI := range networks {
logic.CreateDefaultNetworkRolesAndGroups(models.NetworkID(netI.NetID))
networkNodes := logic.GetNetworkNodesMemory(nodes, netI.NetID)
for _, networkNodeI := range networkNodes {
if networkNodeI.IsIngressGateway {
h, err := logic.GetHost(networkNodeI.HostID.String())
if err == nil {
logic.CreateRole(models.UserRolePermissionTemplate{
ID: models.GetRAGRoleID(networkNodeI.Network, h.ID.String()),
UiName: models.GetRAGRoleName(networkNodeI.Network, h.Name),
NetworkID: models.NetworkID(netI.NetID),
NetworkLevelAccess: map[models.RsrcType]map[models.RsrcID]models.RsrcPermissionScope{
models.RemoteAccessGwRsrc: {
models.RsrcID(networkNodeI.ID.String()): models.RsrcPermissionScope{
Read: true,
VPNaccess: true,
},
},
models.ExtClientsRsrc: {
models.AllExtClientsRsrcID: models.RsrcPermissionScope{
Read: true,
Create: true,
Update: true,
Delete: true,
SelfOnly: true,
},
},
},
})
}
}
}
}
}
}
@ -429,34 +398,11 @@ func syncUsers() {
user.PlatformRoleID = models.ServiceUser
}
logic.UpsertUser(user)
if len(user.RemoteGwIDs) > 0 {
// define user roles for network
// assign relevant network role to user
for remoteGwID := range user.RemoteGwIDs {
gwNode, err := logic.GetNodeByID(remoteGwID)
if err != nil {
continue
}
h, err := logic.GetHost(gwNode.HostID.String())
if err != nil {
continue
}
r, err := logic.GetRole(models.GetRAGRoleID(gwNode.Network, h.ID.String()))
if err != nil {
continue
}
if netRoles, ok := user.NetworkRoles[models.NetworkID(gwNode.Network)]; ok {
netRoles[r.ID] = struct{}{}
} else {
user.NetworkRoles[models.NetworkID(gwNode.Network)] = map[models.UserRoleID]struct{}{
r.ID: {},
}
}
}
logic.UpsertUser(user)
}
logic.MigrateUserRoleAndGroups(user)
}
}
}
func createDefaultTagsAndPolicies() {

5
models/user_mgmt.go
View file

@ -116,8 +116,9 @@ type RsrcPermissionScope struct {
type UserRolePermissionTemplate struct {
ID UserRoleID `json:"id"`
UiName string `json:"ui_name"`
Name string `json:"name"`
Default bool `json:"default"`
MetaData string `json:"meta_data"`
DenyDashboardAccess bool `json:"deny_dashboard_access"`
FullAccess bool `json:"full_access"`
NetworkID NetworkID `json:"network_id"`
@ -132,6 +133,8 @@ type CreateGroupReq struct {
type UserGroup struct {
ID UserGroupID `json:"id"`
Default bool `json:"default"`
Name string `json:"name"`
NetworkRoles map[NetworkID]map[UserRoleID]struct{} `json:"network_roles"`
MetaData string `json:"meta_data"`
}

2
pro/initialize.go
View file

@ -136,6 +136,8 @@ func InitPro() {
logic.InitialiseRoles = proLogic.UserRolesInit
logic.UpdateUserGwAccess = proLogic.UpdateUserGwAccess
logic.CreateDefaultUserPolicies = proLogic.CreateDefaultUserPolicies
logic.MigrateUserRoleAndGroups = proLogic.MigrateUserRoleAndGroups
logic.IntialiseGroups = proLogic.UserGroupsInit
}
func retrieveProLogo() string {

54
pro/logic/migrate.go Normal file
View file

@ -0,0 +1,54 @@
package logic
import (
"fmt"
"github.com/gravitl/netmaker/logic"
"github.com/gravitl/netmaker/models"
)
func MigrateUserRoleAndGroups(user models.User) {
var err error
if len(user.RemoteGwIDs) > 0 {
// define user roles for network
// assign relevant network role to user
for remoteGwID := range user.RemoteGwIDs {
gwNode, err := logic.GetNodeByID(remoteGwID)
if err != nil {
continue
}
var g models.UserGroup
if user.PlatformRoleID == models.ServiceUser {
g, err = GetUserGroup(models.UserGroupID(fmt.Sprintf("%s-%s-grp", gwNode.Network, models.NetworkUser)))
} else {
g, err = GetUserGroup(models.UserGroupID(fmt.Sprintf("%s-%s-grp",
gwNode.Network, models.NetworkAdmin)))
}
if err != nil {
continue
}
user.UserGroups[g.ID] = struct{}{}
}
}
if len(user.NetworkRoles) > 0 {
for netID := range user.NetworkRoles {
var g models.UserGroup
if user.PlatformRoleID == models.ServiceUser {
g, err = GetUserGroup(models.UserGroupID(fmt.Sprintf("%s-%s-grp", netID, models.NetworkUser)))
} else {
g, err = GetUserGroup(models.UserGroupID(fmt.Sprintf("%s-%s-grp",
netID, models.NetworkAdmin)))
}
if err != nil {
continue
}
user.UserGroups[g.ID] = struct{}{}
if err != nil {
continue
}
}
}
logic.UpsertUser(user)
}

44
pro/logic/user_mgmt.go
View file

@ -30,6 +30,8 @@ var PlatformUserUserPermissionTemplate = models.UserRolePermissionTemplate{
var NetworkAdminAllPermissionTemplate = models.UserRolePermissionTemplate{
ID: models.UserRoleID(fmt.Sprintf("global-%s", models.NetworkAdmin)),
Name: "Network Admins",
MetaData: "Users with this role can manage all your networks configuration including adding and removing devices.",
Default: true,
FullAccess: true,
NetworkID: models.AllNetworks,
@ -37,6 +39,8 @@ var NetworkAdminAllPermissionTemplate = models.UserRolePermissionTemplate{
var NetworkUserAllPermissionTemplate = models.UserRolePermissionTemplate{
ID: models.UserRoleID(fmt.Sprintf("global-%s", models.NetworkUser)),
Name: "Network Users",
MetaData: "Users with this role Cannot access the admin console, but can connect to nodes in your networks via RAC.",
Default: true,
FullAccess: false,
NetworkID: models.AllNetworks,
@ -75,12 +79,44 @@ func UserRolesInit() {
}
func UserGroupsInit() {
// create default network groups
var NetworkGlobalAdminGroup = models.UserGroup{
ID: models.UserGroupID(fmt.Sprintf("global-%s-grp", models.NetworkAdmin)),
Default: true,
Name: "Network Admin Group",
MetaData: "Users in this group can manage all your networks configuration including adding and removing devices.",
NetworkRoles: map[models.NetworkID]map[models.UserRoleID]struct{}{
models.NetworkID("*"): {
models.UserRoleID(fmt.Sprintf("global-%s", models.NetworkAdmin)): {},
},
},
}
var NetworkGlobalUserGroup = models.UserGroup{
ID: models.UserGroupID(fmt.Sprintf("global-%s-grp", models.NetworkUser)),
Name: "Network User Group",
Default: true,
NetworkRoles: map[models.NetworkID]map[models.UserRoleID]struct{}{
models.NetworkID("*"): {
models.UserRoleID(fmt.Sprintf("global-%s", models.NetworkUser)): {},
},
},
MetaData: "Users in this group cannot access the admin console, but can connect to nodes in your networks via RAC.",
}
d, _ := json.Marshal(NetworkGlobalAdminGroup)
database.Insert(NetworkGlobalAdminGroup.ID.String(), string(d), database.USER_GROUPS_TABLE_NAME)
d, _ = json.Marshal(NetworkGlobalUserGroup)
database.Insert(NetworkGlobalUserGroup.ID.String(), string(d), database.USER_GROUPS_TABLE_NAME)
}
func CreateDefaultNetworkRolesAndGroups(netID models.NetworkID) {
if netID.String() == "" {
return
}
var NetworkAdminPermissionTemplate = models.UserRolePermissionTemplate{
ID: models.UserRoleID(fmt.Sprintf("%s-%s", netID, models.NetworkAdmin)),
Name: fmt.Sprintf("%s Admin", netID),
MetaData: fmt.Sprintf("Users with this role can manage your network `%s` configuration including adding and removing devices.", netID),
Default: true,
NetworkID: netID,
FullAccess: true,
@ -89,6 +125,8 @@ func CreateDefaultNetworkRolesAndGroups(netID models.NetworkID) {
var NetworkUserPermissionTemplate = models.UserRolePermissionTemplate{
ID: models.UserRoleID(fmt.Sprintf("%s-%s", netID, models.NetworkUser)),
Name: fmt.Sprintf("%s User", netID),
MetaData: fmt.Sprintf("Users Cannot access the admin console, but can connect to nodes in your network `%s` via RAC.", netID),
Default: true,
FullAccess: false,
NetworkID: netID,
@ -119,21 +157,23 @@ func CreateDefaultNetworkRolesAndGroups(netID models.NetworkID) {
// create default network groups
var NetworkAdminGroup = models.UserGroup{
ID: models.UserGroupID(fmt.Sprintf("%s-%s-grp", netID, models.NetworkAdmin)),
Name: fmt.Sprintf("%s Admin Group", netID),
NetworkRoles: map[models.NetworkID]map[models.UserRoleID]struct{}{
netID: {
models.UserRoleID(fmt.Sprintf("%s-%s", netID, models.NetworkAdmin)): {},
},
},
MetaData: "The network group was automatically created by Netmaker.",
MetaData: fmt.Sprintf("User in this group can manage your network `%s` configuration including adding and removing devices.", netID),
}
var NetworkUserGroup = models.UserGroup{
ID: models.UserGroupID(fmt.Sprintf("%s-%s-grp", netID, models.NetworkUser)),
Name: fmt.Sprintf("%s User Group", netID),
NetworkRoles: map[models.NetworkID]map[models.UserRoleID]struct{}{
netID: {
models.UserRoleID(fmt.Sprintf("%s-%s", netID, models.NetworkUser)): {},
},
},
MetaData: "The network group was automatically created by Netmaker.",
MetaData: fmt.Sprintf("Users in this group cannot access the admin console, but can connect to nodes in your network `%s` via RAC.", netID),
}
d, _ = json.Marshal(NetworkAdminGroup)
database.Insert(NetworkAdminGroup.ID.String(), string(d), database.USER_GROUPS_TABLE_NAME)