Skip to Main Content
Public Ideas Portal


Status Future consideration
Kong Product Mesh
Created by Karl Kalckstein
Created on Sep 1, 2022

Introduce GET/LIST for RBAC

Introduce GET/LIST to Kong Mesh RBAC, in particular this would be useful for secrets with extra validation because:

The documentation suggests that role access is only required for write access, and not for read access: https://docs.konghq.com/mesh/latest/features/rbac/
A user does not have CREATE permissions to list secrets but when trying to list secrets with `kumactl get secrets` and a user who does not have CREATE permissions an error is thrown:
`Error: Access Denied (user "user/user,mesh-system:authenticated" cannot access the resource)`
and the Kuma log has the following:

{code}
2022-09-01T12:08:52.799Z INFO rbac validating access {"attempt": "9401ae40-fbcd-48c7-a836-1003caf956eb", "access": "CREATE", "key": {"Mesh":"","Name":""}, "spec": "", "resourceType": "Secret", "user": "user/user,mesh-system:authenticated", "rules": [{"types":["TrafficRoute","CircuitBreaker","Retry","Timeout","ExternalService","Secret"],"mesh":"default","access":[0,2,1]}]}
2022-09-01T12:08:52.799Z INFO rbac mesh does not match {"attempt": "9401ae40-fbcd-48c7-a836-1003caf956eb"}
2022-09-01T12:08:52.799Z INFO rbac access denied {"attempt": "9401ae40-fbcd-48c7-a836-1003caf956eb"}
{code}

Today since we don’t have GET/LIST access for all resources we cannot just give access to Secret like we do for any other resource. Therefore we require CREATE.

  • Attach files
1 MERGED

Add get / list to RBAC

Merged
No description provided
John Harris over 1 year ago in Mesh 0 Future consideration