You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "gabriel-farache (via GitHub)" <gi...@apache.org> on 2024/03/25 15:36:34 UTC
[I] Support of security properties in the sonataflowplatforms for Workflows and Data Index [incubator-kie-kogito-serverless-operator]
gabriel-farache opened a new issue, #436:
URL: https://github.com/apache/incubator-kie-kogito-serverless-operator/issues/436
### Description
In order to ease the security settings of workflows, setting the [quarkus.http.auth.permission](https://quarkus.io/version/3.8/guides/all-config#quarkus-vertx-http_quarkus-http-auth-permission-permissions-enabled) and [quarkus.http.auth.policy](https://quarkus.io/version/3.8/guides/all-config#quarkus-vertx-http_quarkus-http-auth-policy-role-policy-roles-allowed) properties at runtime (once the runtime will be using a quarkus version allowing it) in the `sonataflowplatforms` CR and then have those properties propagated to all running workflows (via `props` or `managed` configmap) would be of great help.
Same applied for [quarkus.oidc](https://quarkus.io/version/3.8/guides/all-config#quarkus-oidc_quarkus-oidc-auth-server-url) properties in order to only setup the provider connection once.
Need to consider [quarkus.oidc.credentials.secret](https://quarkus.io/version/3.8/guides/all-config#quarkus-oidc_quarkus-oidc-credentials-secret), which should be in a secret and not a configmap but nonetheless provided to the workflows.
In addition, the Data Index having (at least) the `/graphql` exposing information about the workflows, it shall also be protected, so having a separation between properties for the DataIndex and the Workflows is needed.
For the provider, the clients may not be the same, so same applies.
### Implementation ideas
_No response_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [I] Support of security properties in the sonataflowplatforms for Workflows and Data Index [incubator-kie-kogito-serverless-operator]
Posted by "ricardozanini (via GitHub)" <gi...@apache.org>.
ricardozanini commented on issue #436:
URL: https://github.com/apache/incubator-kie-kogito-serverless-operator/issues/436#issuecomment-2047665172
> I wonder about selectivity: if we wish to have the properties propagated only to part of the workflows, should we enable a selector to apply the properties? I was thinking of the need to enable properties only for workflows with prod profile (annotation) or based on a specific label.
For this one, I think we should handle in another issue since it might have other implications that we need to dig into.
> Lastly, the name property name quarkus.http.auth.permission in the example will fail to match the [C_IDENTIFIER](https://go.googlesource.com/build/+/2adbdc4d9838bd45014dac2537d7f4926c5b9d6d/kubernetes/api/types.go#35) as pointed from the envvar spec:
oh that was a doc bug I'll override. The problem is that we are using the k8s types from `EnvVar`, which of course must match `C_IDENTIFIER`. In our case, it does not.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [I] Support of security properties in the sonataflowplatforms for Workflows and Data Index [incubator-kie-kogito-serverless-operator]
Posted by "ricardozanini (via GitHub)" <gi...@apache.org>.
ricardozanini commented on issue #436:
URL: https://github.com/apache/incubator-kie-kogito-serverless-operator/issues/436#issuecomment-2045862615
I'll add a few implementation ideas here so others can chime in. If needed, I can create a design doc.
So I think we can have a `.spec.properties.flow` within the `SonataFlowPlatform` interface. This attribute can be a map of a complex object derived from the [Kubernetes Env Var](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.25/#envvar-v1-core) API, meaning that the propagated properties can be defined directly to the CR. Example:
```yaml
apiVersion: sonataflow.org/v1alpha08
kind: SonataFlowPlatform
metadata:
name: sonataflow-platform
spec:
properties:
flow:
- name: quarkus.http.auth.permission
value: myValueForTheProperty
- name: quarkus.http.auth.policy
valueFrom:
secretKeyRef: my-secret
keyName: my-policy
optional: false
- name: quarkus.other.property
valueFrom:
configMapRef: my-config-map
keyName: my-property
optional: false
```
So one can either set the value directly, from a secret or configMap.
We use `.spec.properties.flow` to have some room to add properties for the Data Index, or any other supporting service or future actor in the platform.
## Cluster Platform
In the cluster platform, we are going to set the `.spec.capabilities` to `properties.flow` by default. So one can set to an empty value if the cluster platform does not propagate the properties to the whole cluster.
@masayag @gabriel-farache @wmedvede @jakubschwan please let me know what you think.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [I] Support of security properties in the sonataflowplatforms for Workflows and Data Index [incubator-kie-kogito-serverless-operator]
Posted by "masayag (via GitHub)" <gi...@apache.org>.
masayag commented on issue #436:
URL: https://github.com/apache/incubator-kie-kogito-serverless-operator/issues/436#issuecomment-2046666841
This proposed design should satisfy the requirements of having a method to propagate workflows globally.
I wonder about selectivity: if we wish to have the properties propagated only to part of the workflows, should we enable a selector to apply the properties? I was thinking of the need to enable properties only for workflows with `prod` profile (annotation) or based on a specific label.
Lastly, the name property name `quarkus.http.auth.permission` in the example will fail to match the [C_IDENTIFIER](https://go.googlesource.com/build/+/2adbdc4d9838bd45014dac2537d7f4926c5b9d6d/kubernetes/api/types.go#35) as pointed from the envvar spec:
> name
> string Name of the environment variable. Must be a C_IDENTIFIER.
>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [I] Support of security properties in the sonataflowplatforms for Workflows and Data Index [incubator-kie-kogito-serverless-operator]
Posted by "ricardozanini (via GitHub)" <gi...@apache.org>.
ricardozanini closed issue #436: Support of security properties in the sonataflowplatforms for Workflows and Data Index
URL: https://github.com/apache/incubator-kie-kogito-serverless-operator/issues/436
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org