Skip to content

Commit a4901ef

Browse files
shaoting-huangshaoting-huang
authored
fix: [2.5] fix privilege group list and list collections (#38738)
cherry-pick from: #38684 related: #37031 Signed-off-by: shaoting-huang <[email protected]>
1 parent f441ccd commit a4901ef

File tree

11 files changed

+265
-212
lines changed

11 files changed

+265
-212
lines changed

‎client/milvusclient/rbac_test.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -399,11 +399,11 @@ func TestRoleRBAC(t *testing.T) {
399399
suite.Run(t, new(RoleSuite))
400400
}
401401

402-
type PrivilgeGroupSuite struct {
402+
type PrivilegeGroupSuite struct {
403403
MockSuiteBase
404404
}
405405

406-
func (s *PrivilgeGroupSuite) TestGrantV2() {
406+
func (s *PrivilegeGroupSuite) TestGrantV2() {
407407
ctx, cancel := context.WithCancel(context.Background())
408408
defer cancel()
409409

@@ -433,7 +433,7 @@ func (s *PrivilgeGroupSuite) TestGrantV2() {
433433
})
434434
}
435435

436-
func (s *PrivilgeGroupSuite) TestRevokeV2() {
436+
func (s *PrivilegeGroupSuite) TestRevokeV2() {
437437
ctx, cancel := context.WithCancel(context.Background())
438438
defer cancel()
439439

@@ -463,7 +463,7 @@ func (s *PrivilgeGroupSuite) TestRevokeV2() {
463463
})
464464
}
465465

466-
func (s *PrivilgeGroupSuite) TestCreatePrivilegeGroup() {
466+
func (s *PrivilegeGroupSuite) TestCreatePrivilegeGroup() {
467467
ctx, cancel := context.WithCancel(context.Background())
468468
defer cancel()
469469

@@ -487,7 +487,7 @@ func (s *PrivilgeGroupSuite) TestCreatePrivilegeGroup() {
487487
})
488488
}
489489

490-
func (s *PrivilgeGroupSuite) TestDropPrivilegeGroup() {
490+
func (s *PrivilegeGroupSuite) TestDropPrivilegeGroup() {
491491
ctx, cancel := context.WithCancel(context.Background())
492492
defer cancel()
493493

@@ -511,7 +511,7 @@ func (s *PrivilgeGroupSuite) TestDropPrivilegeGroup() {
511511
})
512512
}
513513

514-
func (s *PrivilgeGroupSuite) TestListPrivilegeGroups() {
514+
func (s *PrivilegeGroupSuite) TestListPrivilegeGroups() {
515515
ctx, cancel := context.WithCancel(context.Background())
516516
defer cancel()
517517

@@ -548,7 +548,7 @@ func (s *PrivilgeGroupSuite) TestListPrivilegeGroups() {
548548
})
549549
}
550550

551-
func (s *PrivilgeGroupSuite) TestOperatePrivilegeGroup() {
551+
func (s *PrivilegeGroupSuite) TestOperatePrivilegeGroup() {
552552
ctx, cancel := context.WithCancel(context.Background())
553553
defer cancel()
554554

@@ -575,5 +575,5 @@ func (s *PrivilgeGroupSuite) TestOperatePrivilegeGroup() {
575575
}
576576

577577
func TestPrivilegeGroup(t *testing.T) {
578-
suite.Run(t, new(PrivilgeGroupSuite))
578+
suite.Run(t, new(PrivilegeGroupSuite))
579579
}

‎configs/milvus.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -829,7 +829,7 @@ common:
829829
superUsers:
830830
defaultRootPassword: "Milvus" # default password for root user. The maximum length is 72 characters, and double quotes are required.
831831
rbac:
832-
overrideBuiltInPrivilgeGroups:
832+
overrideBuiltInPrivilegeGroups:
833833
enabled: false # Whether to override build-in privilege groups
834834
cluster:
835835
readonly:

‎internal/proxy/privilege_interceptor_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -576,9 +576,9 @@ func TestBuiltinPrivilegeGroup(t *testing.T) {
576576
mgr := newShardClientMgr()
577577

578578
policies := []string{}
579-
for _, priv := range util.BuiltinPrivilegeGroups["ClusterReadOnly"] {
580-
objectType := util.GetObjectType(priv)
581-
policies = append(policies, funcutil.PolicyForPrivilege("role1", objectType, "*", util.PrivilegeNameForMetastore(priv), "default"))
579+
for _, priv := range Params.RbacConfig.GetDefaultPrivilegeGroup("ClusterReadOnly").Privileges {
580+
objectType := util.GetObjectType(priv.Name)
581+
policies = append(policies, funcutil.PolicyForPrivilege("role1", objectType, "*", util.PrivilegeNameForMetastore(priv.Name), "default"))
582582
}
583583
client.listPolicy = func(ctx context.Context, in *internalpb.ListPolicyRequest) (*internalpb.ListPolicyResponse, error) {
584584
return &internalpb.ListPolicyResponse{

‎internal/rootcoord/root_coord.go

+3-56
Original file line numberDiff line numberDiff line change
@@ -638,50 +638,6 @@ func (c *Core) initPublicRolePrivilege() error {
638638
return nil
639639
}
640640

641-
func (c *Core) initBuiltinPrivilegeGroups() []*milvuspb.PrivilegeGroupInfo {
642-
// init built in privilege groups, override by config if rbac config enabled
643-
builtinGroups := make([]*milvuspb.PrivilegeGroupInfo, 0)
644-
for groupName, privileges := range util.BuiltinPrivilegeGroups {
645-
if Params.RbacConfig.Enabled.GetAsBool() {
646-
var confPrivs []string
647-
switch groupName {
648-
case "ClusterReadOnly":
649-
confPrivs = Params.RbacConfig.ClusterReadOnlyPrivileges.GetAsStrings()
650-
case "ClusterReadWrite":
651-
confPrivs = Params.RbacConfig.ClusterReadWritePrivileges.GetAsStrings()
652-
case "ClusterAdmin":
653-
confPrivs = Params.RbacConfig.ClusterAdminPrivileges.GetAsStrings()
654-
case "DatabaseReadOnly":
655-
confPrivs = Params.RbacConfig.DBReadOnlyPrivileges.GetAsStrings()
656-
case "DatabaseReadWrite":
657-
confPrivs = Params.RbacConfig.DBReadWritePrivileges.GetAsStrings()
658-
case "DatabaseAdmin":
659-
confPrivs = Params.RbacConfig.DBAdminPrivileges.GetAsStrings()
660-
case "CollectionReadOnly":
661-
confPrivs = Params.RbacConfig.CollectionReadOnlyPrivileges.GetAsStrings()
662-
case "CollectionReadWrite":
663-
confPrivs = Params.RbacConfig.CollectionReadWritePrivileges.GetAsStrings()
664-
case "CollectionAdmin":
665-
confPrivs = Params.RbacConfig.CollectionAdminPrivileges.GetAsStrings()
666-
default:
667-
return nil
668-
}
669-
if len(confPrivs) > 0 {
670-
privileges = confPrivs
671-
}
672-
}
673-
674-
privs := lo.Map(privileges, func(name string, _ int) *milvuspb.PrivilegeEntity {
675-
return &milvuspb.PrivilegeEntity{Name: name}
676-
})
677-
builtinGroups = append(builtinGroups, &milvuspb.PrivilegeGroupInfo{
678-
GroupName: groupName,
679-
Privileges: privs,
680-
})
681-
}
682-
return builtinGroups
683-
}
684-
685641
func (c *Core) initBuiltinRoles() error {
686642
log := log.Ctx(c.ctx)
687643
rolePrivilegesMap := Params.RoleCfg.Roles.GetAsRoleDetails()
@@ -2648,7 +2604,7 @@ func (c *Core) isValidPrivilege(ctx context.Context, privilegeName string, objec
26482604
if customPrivGroup {
26492605
return fmt.Errorf("can not operate the custom privilege group [%s]", privilegeName)
26502606
}
2651-
if lo.Contains(lo.Keys(util.BuiltinPrivilegeGroups), privilegeName) {
2607+
if lo.Contains(Params.RbacConfig.GetDefaultPrivilegeGroupNames(), privilegeName) {
26522608
return fmt.Errorf("can not operate the built-in privilege group [%s]", privilegeName)
26532609
}
26542610
// check object privileges for built-in privileges
@@ -2757,7 +2713,7 @@ func (c *Core) OperatePrivilege(ctx context.Context, in *milvuspb.OperatePrivile
27572713
grants := []*milvuspb.GrantEntity{in.Entity}
27582714

27592715
allGroups, err := c.meta.ListPrivilegeGroups(ctx)
2760-
allGroups = append(allGroups, c.initBuiltinPrivilegeGroups()...)
2716+
allGroups = append(allGroups, Params.RbacConfig.GetDefaultPrivilegeGroups()...)
27612717
if err != nil {
27622718
return nil, err
27632719
}
@@ -3243,16 +3199,7 @@ func (c *Core) ListPrivilegeGroups(ctx context.Context, in *milvuspb.ListPrivile
32433199
metrics.RootCoordDDLReqLatency.WithLabelValues(method).Observe(float64(tr.ElapseSpan().Milliseconds()))
32443200

32453201
// append built in privilege groups
3246-
for groupName, privileges := range util.BuiltinPrivilegeGroups {
3247-
privGroups = append(privGroups, &milvuspb.PrivilegeGroupInfo{
3248-
GroupName: groupName,
3249-
Privileges: lo.Map(privileges, func(p string, _ int) *milvuspb.PrivilegeEntity {
3250-
return &milvuspb.PrivilegeEntity{
3251-
Name: p,
3252-
}
3253-
}),
3254-
})
3255-
}
3202+
privGroups = append(privGroups, Params.RbacConfig.GetDefaultPrivilegeGroups()...)
32563203
return &milvuspb.ListPrivilegeGroupsResponse{
32573204
Status: merr.Success(),
32583205
PrivilegeGroups: privGroups,

‎internal/rootcoord/root_coord_test.go

-23
Original file line numberDiff line numberDiff line change
@@ -2037,29 +2037,6 @@ func TestCore_InitRBAC(t *testing.T) {
20372037
err := c.initRbac()
20382038
assert.NoError(t, err)
20392039
})
2040-
2041-
t.Run("init default privilege groups", func(t *testing.T) {
2042-
clusterReadWrite := `SelectOwnership,SelectUser,DescribeResourceGroup`
2043-
meta := mockrootcoord.NewIMetaTable(t)
2044-
c := newTestCore(withHealthyCode(), withMeta(meta))
2045-
2046-
Params.Save(Params.RbacConfig.Enabled.Key, "true")
2047-
Params.Save(Params.RbacConfig.ClusterReadWritePrivileges.Key, clusterReadWrite)
2048-
2049-
defer func() {
2050-
Params.Reset(Params.RbacConfig.Enabled.Key)
2051-
Params.Reset(Params.RbacConfig.ClusterReadWritePrivileges.Key)
2052-
}()
2053-
2054-
builtinGroups := c.initBuiltinPrivilegeGroups()
2055-
fmt.Println(builtinGroups)
2056-
assert.Equal(t, len(util.BuiltinPrivilegeGroups), len(builtinGroups))
2057-
for _, group := range builtinGroups {
2058-
if group.GroupName == "ClusterReadWrite" {
2059-
assert.Equal(t, len(group.Privileges), 3)
2060-
}
2061-
}
2062-
})
20632040
}
20642041

20652042
func TestCore_BackupRBAC(t *testing.T) {

‎internal/rootcoord/show_collection_task.go

+5-2
Original file line numberDiff line numberDiff line change
@@ -88,12 +88,15 @@ func (t *showCollectionTask) Execute(ctx context.Context) error {
8888
}
8989
for _, entity := range entities {
9090
objectType := entity.GetObject().GetName()
91+
priv := entity.GetGrantor().GetPrivilege().GetName()
9192
if objectType == commonpb.ObjectType_Global.String() &&
92-
entity.GetGrantor().GetPrivilege().GetName() == util.PrivilegeNameForAPI(commonpb.ObjectPrivilege_PrivilegeAll.String()) {
93+
priv == util.PrivilegeNameForAPI(commonpb.ObjectPrivilege_PrivilegeAll.String()) {
9394
privilegeColls.Insert(util.AnyWord)
9495
return privilegeColls, nil
9596
}
96-
if objectType != commonpb.ObjectType_Collection.String() {
97+
// should list collection level built-in privilege group objects
98+
if objectType != commonpb.ObjectType_Collection.String() &&
99+
!Params.RbacConfig.IsCollectionPrivilegeGroup(priv) {
97100
continue
98101
}
99102
collectionName := entity.GetObjectName()

‎internal/rootcoord/show_collection_task_test.go

+51
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,57 @@ func TestShowCollectionsAuth(t *testing.T) {
325325
assert.Equal(t, "foo", task.Rsp.GetCollectionNames()[0])
326326
})
327327

328+
t.Run("collection level privilege group", func(t *testing.T) {
329+
Params.Save(Params.CommonCfg.AuthorizationEnabled.Key, "true")
330+
defer Params.Reset(Params.CommonCfg.AuthorizationEnabled.Key)
331+
meta := mockrootcoord.NewIMetaTable(t)
332+
core := newTestCore(withMeta(meta))
333+
334+
meta.EXPECT().SelectUser(mock.Anything, mock.Anything, mock.Anything, mock.Anything).
335+
Return([]*milvuspb.UserResult{
336+
{
337+
User: &milvuspb.UserEntity{
338+
Name: "foo",
339+
},
340+
Roles: []*milvuspb.RoleEntity{
341+
{
342+
Name: "hoooo",
343+
},
344+
},
345+
},
346+
}, nil).Once()
347+
meta.EXPECT().SelectGrant(mock.Anything, mock.Anything, mock.Anything).Return([]*milvuspb.GrantEntity{
348+
{
349+
Object: &milvuspb.ObjectEntity{Name: commonpb.ObjectType_Global.String()},
350+
Grantor: &milvuspb.GrantorEntity{
351+
Privilege: &milvuspb.PrivilegeEntity{
352+
Name: util.PrivilegeNameForAPI(commonpb.ObjectPrivilege_PrivilegeGroupCollectionReadOnly.String()),
353+
},
354+
},
355+
ObjectName: util.AnyWord,
356+
},
357+
}, nil).Once()
358+
meta.EXPECT().ListCollections(mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([]*model.Collection{
359+
{
360+
DBID: 1,
361+
CollectionID: 100,
362+
Name: "foo",
363+
CreateTime: tsoutil.GetCurrentTime(),
364+
},
365+
}, nil).Once()
366+
367+
task := &showCollectionTask{
368+
baseTask: newBaseTask(context.Background(), core),
369+
Req: &milvuspb.ShowCollectionsRequest{DbName: "default"},
370+
Rsp: &milvuspb.ShowCollectionsResponse{},
371+
}
372+
ctx := GetContext(context.Background(), "foo:root")
373+
err := task.Execute(ctx)
374+
assert.NoError(t, err)
375+
assert.Equal(t, 1, len(task.Rsp.GetCollectionNames()))
376+
assert.Equal(t, "foo", task.Rsp.GetCollectionNames()[0])
377+
})
378+
328379
t.Run("all collection", func(t *testing.T) {
329380
Params.Save(Params.CommonCfg.AuthorizationEnabled.Key, "true")
330381
defer Params.Reset(Params.CommonCfg.AuthorizationEnabled.Key)

‎pkg/util/constant.go

-95
Original file line numberDiff line numberDiff line change
@@ -290,101 +290,6 @@ var (
290290
commonpb.ObjectPrivilege_PrivilegeAlterDatabase.String(),
291291
commonpb.ObjectPrivilege_PrivilegeFlush.String(),
292292
}
293-
294-
BuiltinPrivilegeGroups = map[string][]string{
295-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupCollectionReadOnly.String()): CollectionReadOnlyPrivilegeGroup,
296-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupCollectionReadWrite.String()): CollectionReadWritePrivilegeGroup,
297-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupCollectionAdmin.String()): CollectionAdminPrivilegeGroup,
298-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupDatabaseReadOnly.String()): DatabaseReadOnlyPrivilegeGroup,
299-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupDatabaseReadWrite.String()): DatabaseReadWritePrivilegeGroup,
300-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupDatabaseAdmin.String()): DatabaseAdminPrivilegeGroup,
301-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupClusterReadOnly.String()): ClusterReadOnlyPrivilegeGroup,
302-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupClusterReadWrite.String()): ClusterReadWritePrivilegeGroup,
303-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupClusterAdmin.String()): ClusterAdminPrivilegeGroup,
304-
}
305-
306-
CollectionReadOnlyPrivilegeGroup = []string{
307-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeQuery.String()),
308-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeSearch.String()),
309-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeIndexDetail.String()),
310-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetFlushState.String()),
311-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetLoadState.String()),
312-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetLoadingProgress.String()),
313-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeHasPartition.String()),
314-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeShowPartitions.String()),
315-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeCollection.String()),
316-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeAlias.String()),
317-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetStatistics.String()),
318-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListAliases.String()),
319-
}
320-
321-
CollectionReadWritePrivilegeGroup = append(CollectionReadOnlyPrivilegeGroup,
322-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeLoad.String()),
323-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeRelease.String()),
324-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeInsert.String()),
325-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDelete.String()),
326-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeUpsert.String()),
327-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeImport.String()),
328-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeFlush.String()),
329-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCompaction.String()),
330-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeLoadBalance.String()),
331-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateIndex.String()),
332-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropIndex.String()),
333-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreatePartition.String()),
334-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropPartition.String()),
335-
)
336-
337-
CollectionAdminPrivilegeGroup = append(CollectionReadWritePrivilegeGroup,
338-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateAlias.String()),
339-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropAlias.String()),
340-
)
341-
342-
DatabaseReadOnlyPrivilegeGroup = []string{
343-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeShowCollections.String()),
344-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeDatabase.String()),
345-
}
346-
347-
DatabaseReadWritePrivilegeGroup = append(DatabaseReadOnlyPrivilegeGroup,
348-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeAlterDatabase.String()),
349-
)
350-
351-
DatabaseAdminPrivilegeGroup = append(DatabaseReadWritePrivilegeGroup,
352-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateCollection.String()),
353-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropCollection.String()),
354-
)
355-
356-
ClusterReadOnlyPrivilegeGroup = []string{
357-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListDatabases.String()),
358-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeSelectOwnership.String()),
359-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeSelectUser.String()),
360-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeResourceGroup.String()),
361-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListResourceGroups.String()),
362-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListPrivilegeGroups.String()),
363-
}
364-
365-
ClusterReadWritePrivilegeGroup = append(ClusterReadOnlyPrivilegeGroup,
366-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeFlushAll.String()),
367-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeTransferNode.String()),
368-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeTransferReplica.String()),
369-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeUpdateResourceGroups.String()),
370-
)
371-
372-
ClusterAdminPrivilegeGroup = append(ClusterReadWritePrivilegeGroup,
373-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeBackupRBAC.String()),
374-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeRestoreRBAC.String()),
375-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateDatabase.String()),
376-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropDatabase.String()),
377-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateOwnership.String()),
378-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropOwnership.String()),
379-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeManageOwnership.String()),
380-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateResourceGroup.String()),
381-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropResourceGroup.String()),
382-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeUpdateUser.String()),
383-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeRenameCollection.String()),
384-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreatePrivilegeGroup.String()),
385-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropPrivilegeGroup.String()),
386-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeOperatePrivilegeGroup.String()),
387-
)
388293
)
389294

390295
// StringSet convert array to map for conveniently check if the array contains an element

0 commit comments

Comments
 (0)