Skip to content

[v14] Remove access lists and members from the cache. #33322

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mdwn merged 1 commit into from
Oct 12, 2023
Merged

[v14] Remove access lists and members from the cache. #33322

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 0 additions & 78 deletions lib/cache/cache.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,6 @@ import (
"github.com/gravitational/teleport/api/client/proto"
apidefaults "github.com/gravitational/teleport/api/defaults"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/api/types/accesslist"
"github.com/gravitational/teleport/api/types/discoveryconfig"
"github.com/gravitational/teleport/api/types/userloginstate"
"github.com/gravitational/teleport/api/utils/retryutils"
Expand Down Expand Up @@ -117,9 +116,7 @@ func ForAuth(cfg Config) Config {
{Kind: types.KindOktaAssignment},
{Kind: types.KindIntegration},
{Kind: types.KindHeadlessAuthentication},
{Kind: types.KindAccessList},
{Kind: types.KindUserLoginState},
{Kind: types.KindAccessListMember},
{Kind: types.KindDiscoveryConfig},
}
cfg.QueueSize = defaults.AuthQueueSize
Expand Down Expand Up @@ -479,7 +476,6 @@ type Cache struct {
integrationsCache services.Integrations
discoveryConfigsCache services.DiscoveryConfigs
headlessAuthenticationsCache services.HeadlessAuthenticationService
accessListsCache services.AccessLists
userLoginStateCache services.UserLoginStates
eventsFanout *services.FanoutSet

Expand Down Expand Up @@ -636,8 +632,6 @@ type Config struct {
Integrations services.Integrations
// DiscoveryConfigs is a DiscoveryConfigs service.
DiscoveryConfigs services.DiscoveryConfigs
// AccessLists is the access list service.
AccessLists services.AccessLists
// UserLoginStates is the user login state service.
UserLoginStates services.UserLoginStates
// Backend is a backend for local cache
Expand Down Expand Up @@ -815,12 +809,6 @@ func New(config Config) (*Cache, error) {
return nil, trace.Wrap(err)
}

accessListsCache, err := local.NewAccessListService(config.Backend, config.Clock)
if err != nil {
cancel()
return nil, trace.Wrap(err)
}

userLoginStatesCache, err := local.NewUserLoginStateService(config.Backend)
if err != nil {
cancel()
Expand Down Expand Up @@ -857,7 +845,6 @@ func New(config Config) (*Cache, error) {
integrationsCache: integrationsCache,
discoveryConfigsCache: discoveryConfigsCache,
headlessAuthenticationsCache: local.NewIdentityService(config.Backend),
accessListsCache: accessListsCache,
userLoginStateCache: userLoginStatesCache,
eventsFanout: services.NewFanoutSet(),
Logger: log.WithFields(log.Fields{
Expand Down Expand Up @@ -2518,45 +2505,6 @@ func (c *Cache) GetDiscoveryConfig(ctx context.Context, name string) (*discovery
return rg.reader.GetDiscoveryConfig(ctx, name)
}

// ListAccessLists returns a paginated list of all access lists resources.
func (c *Cache) ListAccessLists(ctx context.Context, pageSize int, nextKey string) ([]*accesslist.AccessList, string, error) {
ctx, span := c.Tracer.Start(ctx, "cache/ListAccessLists")
defer span.End()

rg, err := readCollectionCache(c, c.collections.accessLists)
if err != nil {
return nil, "", trace.Wrap(err)
}
defer rg.Release()
return rg.reader.ListAccessLists(ctx, pageSize, nextKey)
}

// GetAccessLists returns a list of all access lists resources.
func (c *Cache) GetAccessLists(ctx context.Context) ([]*accesslist.AccessList, error) {
ctx, span := c.Tracer.Start(ctx, "cache/GetAccessLists")
defer span.End()

rg, err := readCollectionCache(c, c.collections.accessLists)
if err != nil {
return nil, trace.Wrap(err)
}
defer rg.Release()
return rg.reader.GetAccessLists(ctx)
}

// GetAccessList returns the specified access list resource.
func (c *Cache) GetAccessList(ctx context.Context, name string) (*accesslist.AccessList, error) {
ctx, span := c.Tracer.Start(ctx, "cache/GetAccessList")
defer span.End()

rg, err := readCollectionCache(c, c.collections.accessLists)
if err != nil {
return nil, trace.Wrap(err)
}
defer rg.Release()
return rg.reader.GetAccessList(ctx, name)
}

// GetUserLoginStates returns the all user login state resources.
func (c *Cache) GetUserLoginStates(ctx context.Context) ([]*userloginstate.UserLoginState, error) {
ctx, span := c.Tracer.Start(ctx, "cache/GetUserLoginStates")
Expand All @@ -2570,32 +2518,6 @@ func (c *Cache) GetUserLoginStates(ctx context.Context) ([]*userloginstate.UserL
return rg.reader.GetUserLoginStates(ctx)
}

// ListAccessListMembers returns a paginated list of all access list members.
func (c *Cache) ListAccessListMembers(ctx context.Context, accessList string, pageSize int, pageToken string) (members []*accesslist.AccessListMember, nextToken string, err error) {
ctx, span := c.Tracer.Start(ctx, "cache/ListAccessListMembers")
defer span.End()

rg, err := readCollectionCache(c, c.collections.accessListMembers)
if err != nil {
return nil, "", trace.Wrap(err)
}
defer rg.Release()
return rg.reader.ListAccessListMembers(ctx, accessList, pageSize, pageToken)
}

// GetAccessListMember returns the specified access list member resource.
func (c *Cache) GetAccessListMember(ctx context.Context, accessList string, memberName string) (*accesslist.AccessListMember, error) {
ctx, span := c.Tracer.Start(ctx, "cache/GetAccessListMember")
defer span.End()

rg, err := readCollectionCache(c, c.collections.accessListMembers)
if err != nil {
return nil, trace.Wrap(err)
}
defer rg.Release()
return rg.reader.GetAccessListMember(ctx, accessList, memberName)
}

// GetUserLoginState returns the specified user login state resource.
func (c *Cache) GetUserLoginState(ctx context.Context, name string) (*userloginstate.UserLoginState, error) {
ctx, span := c.Tracer.Start(ctx, "cache/GetUserLoginState")
Expand Down
159 changes: 0 additions & 159 deletions lib/cache/cache_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,6 @@ import (
"github.com/gravitational/teleport/api/client/proto"
apidefaults "github.com/gravitational/teleport/api/defaults"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/api/types/accesslist"
"github.com/gravitational/teleport/api/types/discoveryconfig"
"github.com/gravitational/teleport/api/types/header"
"github.com/gravitational/teleport/api/types/trait"
Expand Down Expand Up @@ -94,9 +93,7 @@ type testPack struct {
okta services.Okta
integrations services.Integrations
discoveryConfigs services.DiscoveryConfigs
accessLists services.AccessLists
userLoginStates services.UserLoginStates
accessListMembers services.AccessListMembers
}

// testFuncs are functions to support testing an object in a cache.
Expand Down Expand Up @@ -254,13 +251,6 @@ func newPackWithoutCache(dir string, opts ...packOption) (*testPack, error) {
}
p.discoveryConfigs = dcSvc

alSvc, err := local.NewAccessListService(p.backend, p.backend.Clock())
if err != nil {
return nil, trace.Wrap(err)
}
p.accessLists = alSvc
p.accessListMembers = alSvc

ulsSvc, err := local.NewUserLoginStateService(p.backend)
if err != nil {
return nil, trace.Wrap(err)
Expand Down Expand Up @@ -305,7 +295,6 @@ func newPack(dir string, setupConfig func(c Config) Config, opts ...packOption)
Okta: p.okta,
Integrations: p.integrations,
DiscoveryConfigs: p.discoveryConfigs,
AccessLists: p.accessLists,
UserLoginStates: p.userLoginStates,
MaxRetryPeriod: 200 * time.Millisecond,
EventsC: p.eventsC,
Expand Down Expand Up @@ -703,7 +692,6 @@ func TestCompletenessInit(t *testing.T) {
Okta: p.okta,
Integrations: p.integrations,
DiscoveryConfigs: p.discoveryConfigs,
AccessLists: p.accessLists,
UserLoginStates: p.userLoginStates,
MaxRetryPeriod: 200 * time.Millisecond,
EventsC: p.eventsC,
Expand Down Expand Up @@ -774,7 +762,6 @@ func TestCompletenessReset(t *testing.T) {
Okta: p.okta,
Integrations: p.integrations,
DiscoveryConfigs: p.discoveryConfigs,
AccessLists: p.accessLists,
UserLoginStates: p.userLoginStates,
MaxRetryPeriod: 200 * time.Millisecond,
EventsC: p.eventsC,
Expand Down Expand Up @@ -957,7 +944,6 @@ func TestListResources_NodesTTLVariant(t *testing.T) {
Okta: p.okta,
Integrations: p.integrations,
DiscoveryConfigs: p.discoveryConfigs,
AccessLists: p.accessLists,
UserLoginStates: p.userLoginStates,
MaxRetryPeriod: 200 * time.Millisecond,
EventsC: p.eventsC,
Expand Down Expand Up @@ -1039,7 +1025,6 @@ func initStrategy(t *testing.T) {
Okta: p.okta,
Integrations: p.integrations,
DiscoveryConfigs: p.discoveryConfigs,
AccessLists: p.accessLists,
UserLoginStates: p.userLoginStates,
MaxRetryPeriod: 200 * time.Millisecond,
EventsC: p.eventsC,
Expand Down Expand Up @@ -2148,33 +2133,6 @@ func TestDiscoveryConfig(t *testing.T) {
})
}

// TestAccessLists tests that CRUD operations on access list resources are
// replicated from the backend to the cache.
func TestAccessLists(t *testing.T) {
t.Parallel()

p := newTestPack(t, ForAuth)
t.Cleanup(p.Close)

testResources(t, p, testFuncs[*accesslist.AccessList]{
newResource: func(name string) (*accesslist.AccessList, error) {
return newAccessList(t, name, p.backend.Clock()), nil
},
create: func(ctx context.Context, accessList *accesslist.AccessList) error {
_, err := p.accessLists.UpsertAccessList(ctx, accessList)
return trace.Wrap(err)
},
list: p.accessLists.GetAccessLists,
cacheGet: p.cache.GetAccessList,
cacheList: p.cache.GetAccessLists,
update: func(ctx context.Context, accessList *accesslist.AccessList) error {
_, err := p.accessLists.UpsertAccessList(ctx, accessList)
return trace.Wrap(err)
},
deleteAll: p.accessLists.DeleteAllAccessLists,
})
}

// TestUserLoginStates tests that CRUD operations on user login state resources are
// replicated from the backend to the cache.
func TestUserLoginStates(t *testing.T) {
Expand Down Expand Up @@ -2202,49 +2160,6 @@ func TestUserLoginStates(t *testing.T) {
})
}

// TestAccessListMembers tests that CRUD operations on access list members resources are
// replicated from the backend to the cache.
func TestAccessListMembers(t *testing.T) {
t.Parallel()

p := newTestPack(t, ForAuth)
t.Cleanup(p.Close)

const accessListName = "test-access-list"

clock := clockwork.NewFakeClock()

p.accessLists.UpsertAccessList(context.Background(), newAccessList(t, accessListName, clock))

testResources(t, p, testFuncs[*accesslist.AccessListMember]{
newResource: func(name string) (*accesslist.AccessListMember, error) {
return newAccessListMember(t, accessListName, name), nil
},
create: func(ctx context.Context, member *accesslist.AccessListMember) error {
_, err := p.accessListMembers.UpsertAccessListMember(ctx, member)
return trace.Wrap(err)
},
list: func(ctx context.Context) ([]*accesslist.AccessListMember, error) {
members, _, err := p.accessListMembers.ListAccessListMembers(ctx, accessListName, 0, "")
return members, trace.Wrap(err)
},
cacheGet: func(ctx context.Context, memberName string) (*accesslist.AccessListMember, error) {
return p.cache.GetAccessListMember(ctx, accessListName, memberName)
},
cacheList: func(ctx context.Context) ([]*accesslist.AccessListMember, error) {
members, _, err := p.cache.ListAccessListMembers(ctx, accessListName, 0, "")
return members, trace.Wrap(err)
},
update: func(ctx context.Context, member *accesslist.AccessListMember) error {
_, err := p.accessListMembers.UpsertAccessListMember(ctx, member)
return trace.Wrap(err)
},
deleteAll: func(ctx context.Context) error {
return trace.Wrap(p.accessListMembers.DeleteAllAccessListMembersForAccessList(ctx, accessListName))
},
})
}

// testResources is a generic tester for resources.
func testResources[T types.Resource](t *testing.T, p *testPack, funcs testFuncs[T]) {
ctx := context.Background()
Expand Down Expand Up @@ -2641,8 +2556,6 @@ func newProxyEvents(events types.Events, ignoreKinds []types.WatchKind) *proxyEv
func TestCacheWatchKindExistsInEvents(t *testing.T) {
t.Parallel()

clock := clockwork.NewFakeClock()

cases := map[string]Config{
"ForAuth": ForAuth(Config{}),
"ForProxy": ForProxy(Config{}),
Expand Down Expand Up @@ -2699,9 +2612,7 @@ func TestCacheWatchKindExistsInEvents(t *testing.T) {
types.KindIntegration: &types.IntegrationV1{},
types.KindDiscoveryConfig: newDiscoveryConfig(t, "discovery-config"),
types.KindHeadlessAuthentication: &types.HeadlessAuthentication{},
types.KindAccessList: newAccessList(t, "access-list", clock),
types.KindUserLoginState: newUserLoginState(t, "user-login-state"),
types.KindAccessListMember: newAccessListMember(t, "access-list", "member"),
}

for name, cfg := range cases {
Expand Down Expand Up @@ -2902,56 +2813,6 @@ func TestInvalidDatabases(t *testing.T) {
}
}

func newAccessList(t *testing.T, name string, clock clockwork.Clock) *accesslist.AccessList {
t.Helper()

accessList, err := accesslist.NewAccessList(
header.Metadata{
Name: name,
},
accesslist.Spec{
Title: "title",
Description: "test access list",
Owners: []accesslist.Owner{
{
Name: "test-user1",
Description: "test user 1",
},
{
Name: "test-user2",
Description: "test user 2",
},
},
Audit: accesslist.Audit{
NextAuditDate: clock.Now(),
},
MembershipRequires: accesslist.Requires{
Roles: []string{"mrole1", "mrole2"},
Traits: map[string][]string{
"mtrait1": {"mvalue1", "mvalue2"},
"mtrait2": {"mvalue3", "mvalue4"},
},
},
OwnershipRequires: accesslist.Requires{
Roles: []string{"orole1", "orole2"},
Traits: map[string][]string{
"otrait1": {"ovalue1", "ovalue2"},
"otrait2": {"ovalue3", "ovalue4"},
},
},
Grants: accesslist.Grants{
Roles: []string{"grole1", "grole2"},
Traits: map[string][]string{
"gtrait1": {"gvalue1", "gvalue2"},
"gtrait2": {"gvalue3", "gvalue4"},
},
},
},
)
require.NoError(t, err)
return accessList
}

func newDiscoveryConfig(t *testing.T, name string) *discoveryconfig.DiscoveryConfig {
t.Helper()

Expand Down Expand Up @@ -2990,26 +2851,6 @@ func newUserLoginState(t *testing.T, name string) *userloginstate.UserLoginState
return uls
}

func newAccessListMember(t *testing.T, accessListName, memberName string) *accesslist.AccessListMember {
t.Helper()

member, err := accesslist.NewAccessListMember(
header.Metadata{
Name: memberName,
},
accesslist.AccessListMemberSpec{
AccessList: accessListName,
Name: memberName,
Joined: time.Date(2023, 1, 1, 0, 0, 0, 0, time.UTC),
Expires: time.Date(2024, 1, 1, 0, 0, 0, 0, time.UTC),
Reason: "because",
AddedBy: "test-user1",
},
)
require.NoError(t, err)
return member
}

func withKeepalive[T any](fn func(context.Context, T) (*types.KeepAlive, error)) func(context.Context, T) error {
return func(ctx context.Context, resource T) error {
_, err := fn(ctx, resource)
Expand Down
Loading