Skip to content

Commit ef6aae8

Browse files
shaoting-huangshaoting-huang
authored
fix: [2.4] fix privilege group list and list collections (#38698)
cherry-pick from: #38684 related: #37031 Signed-off-by: shaoting-huang <[email protected]>
1 parent d975139 commit ef6aae8

10 files changed

+257
-204
lines changed

‎configs/milvus.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -803,7 +803,7 @@ common:
803803
superUsers:
804804
defaultRootPassword: "Milvus" # default password for root user. The maximum length is 72 characters, and double quotes are required.
805805
rbac:
806-
overrideBuiltInPrivilgeGroups:
806+
overrideBuiltInPrivilegeGroups:
807807
enabled: false # Whether to override build-in privilege groups
808808
cluster:
809809
readonly:

‎internal/proxy/privilege_interceptor_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -576,9 +576,9 @@ func TestBuiltinPrivilegeGroup(t *testing.T) {
576576
mgr := newShardClientMgr()
577577

578578
policies := []string{}
579-
for _, priv := range util.BuiltinPrivilegeGroups["ClusterReadOnly"] {
580-
objectType := util.GetObjectType(priv)
581-
policies = append(policies, funcutil.PolicyForPrivilege("role1", objectType, "*", util.PrivilegeNameForMetastore(priv), "default"))
579+
for _, priv := range Params.RbacConfig.GetDefaultPrivilegeGroup("ClusterReadOnly").Privileges {
580+
objectType := util.GetObjectType(priv.Name)
581+
policies = append(policies, funcutil.PolicyForPrivilege("role1", objectType, "*", util.PrivilegeNameForMetastore(priv.Name), "default"))
582582
}
583583
client.listPolicy = func(ctx context.Context, in *internalpb.ListPolicyRequest) (*internalpb.ListPolicyResponse, error) {
584584
return &internalpb.ListPolicyResponse{

‎internal/rootcoord/root_coord.go

+3-56
Original file line numberDiff line numberDiff line change
@@ -611,50 +611,6 @@ func (c *Core) initPublicRolePrivilege() error {
611611
return nil
612612
}
613613

614-
func (c *Core) initBuiltinPrivilegeGroups() []*milvuspb.PrivilegeGroupInfo {
615-
// init built in privilege groups, override by config if rbac config enabled
616-
builtinGroups := make([]*milvuspb.PrivilegeGroupInfo, 0)
617-
for groupName, privileges := range util.BuiltinPrivilegeGroups {
618-
if Params.RbacConfig.Enabled.GetAsBool() {
619-
var confPrivs []string
620-
switch groupName {
621-
case "ClusterReadOnly":
622-
confPrivs = Params.RbacConfig.ClusterReadOnlyPrivileges.GetAsStrings()
623-
case "ClusterReadWrite":
624-
confPrivs = Params.RbacConfig.ClusterReadWritePrivileges.GetAsStrings()
625-
case "ClusterAdmin":
626-
confPrivs = Params.RbacConfig.ClusterAdminPrivileges.GetAsStrings()
627-
case "DatabaseReadOnly":
628-
confPrivs = Params.RbacConfig.DBReadOnlyPrivileges.GetAsStrings()
629-
case "DatabaseReadWrite":
630-
confPrivs = Params.RbacConfig.DBReadWritePrivileges.GetAsStrings()
631-
case "DatabaseAdmin":
632-
confPrivs = Params.RbacConfig.DBAdminPrivileges.GetAsStrings()
633-
case "CollectionReadOnly":
634-
confPrivs = Params.RbacConfig.CollectionReadOnlyPrivileges.GetAsStrings()
635-
case "CollectionReadWrite":
636-
confPrivs = Params.RbacConfig.CollectionReadWritePrivileges.GetAsStrings()
637-
case "CollectionAdmin":
638-
confPrivs = Params.RbacConfig.CollectionAdminPrivileges.GetAsStrings()
639-
default:
640-
return nil
641-
}
642-
if len(confPrivs) > 0 {
643-
privileges = confPrivs
644-
}
645-
}
646-
647-
privs := lo.Map(privileges, func(name string, _ int) *milvuspb.PrivilegeEntity {
648-
return &milvuspb.PrivilegeEntity{Name: name}
649-
})
650-
builtinGroups = append(builtinGroups, &milvuspb.PrivilegeGroupInfo{
651-
GroupName: groupName,
652-
Privileges: privs,
653-
})
654-
}
655-
return builtinGroups
656-
}
657-
658614
func (c *Core) initBuiltinRoles() error {
659615
rolePrivilegesMap := Params.RoleCfg.Roles.GetAsRoleDetails()
660616
for role, privilegesJSON := range rolePrivilegesMap {
@@ -2622,7 +2578,7 @@ func (c *Core) isValidPrivilege(ctx context.Context, privilegeName string, objec
26222578
if customPrivGroup {
26232579
return fmt.Errorf("can not operate the custom privilege group [%s]", privilegeName)
26242580
}
2625-
if lo.Contains(lo.Keys(util.BuiltinPrivilegeGroups), privilegeName) {
2581+
if lo.Contains(Params.RbacConfig.GetDefaultPrivilegeGroupNames(), privilegeName) {
26262582
return fmt.Errorf("can not operate the built-in privilege group [%s]", privilegeName)
26272583
}
26282584
// check object privileges for built-in privileges
@@ -2731,7 +2687,7 @@ func (c *Core) OperatePrivilege(ctx context.Context, in *milvuspb.OperatePrivile
27312687
grants := []*milvuspb.GrantEntity{in.Entity}
27322688

27332689
allGroups, err := c.meta.ListPrivilegeGroups()
2734-
allGroups = append(allGroups, c.initBuiltinPrivilegeGroups()...)
2690+
allGroups = append(allGroups, Params.RbacConfig.GetDefaultPrivilegeGroups()...)
27352691
if err != nil {
27362692
return nil, err
27372693
}
@@ -3204,16 +3160,7 @@ func (c *Core) ListPrivilegeGroups(ctx context.Context, in *milvuspb.ListPrivile
32043160
metrics.RootCoordDDLReqLatency.WithLabelValues(method).Observe(float64(tr.ElapseSpan().Milliseconds()))
32053161

32063162
// append built in privilege groups
3207-
for groupName, privileges := range util.BuiltinPrivilegeGroups {
3208-
privGroups = append(privGroups, &milvuspb.PrivilegeGroupInfo{
3209-
GroupName: groupName,
3210-
Privileges: lo.Map(privileges, func(p string, _ int) *milvuspb.PrivilegeEntity {
3211-
return &milvuspb.PrivilegeEntity{
3212-
Name: p,
3213-
}
3214-
}),
3215-
})
3216-
}
3163+
privGroups = append(privGroups, Params.RbacConfig.GetDefaultPrivilegeGroups()...)
32173164
return &milvuspb.ListPrivilegeGroupsResponse{
32183165
Status: merr.Success(),
32193166
PrivilegeGroups: privGroups,

‎internal/rootcoord/root_coord_test.go

-23
Original file line numberDiff line numberDiff line change
@@ -1898,29 +1898,6 @@ func TestCore_InitRBAC(t *testing.T) {
18981898
err := c.initRbac()
18991899
assert.NoError(t, err)
19001900
})
1901-
1902-
t.Run("init default privilege groups", func(t *testing.T) {
1903-
clusterReadWrite := `SelectOwnership,SelectUser,DescribeResourceGroup`
1904-
meta := mockrootcoord.NewIMetaTable(t)
1905-
c := newTestCore(withHealthyCode(), withMeta(meta))
1906-
1907-
Params.Save(Params.RbacConfig.Enabled.Key, "true")
1908-
Params.Save(Params.RbacConfig.ClusterReadWritePrivileges.Key, clusterReadWrite)
1909-
1910-
defer func() {
1911-
Params.Reset(Params.RbacConfig.Enabled.Key)
1912-
Params.Reset(Params.RbacConfig.ClusterReadWritePrivileges.Key)
1913-
}()
1914-
1915-
builtinGroups := c.initBuiltinPrivilegeGroups()
1916-
fmt.Println(builtinGroups)
1917-
assert.Equal(t, len(util.BuiltinPrivilegeGroups), len(builtinGroups))
1918-
for _, group := range builtinGroups {
1919-
if group.GroupName == "ClusterReadWrite" {
1920-
assert.Equal(t, len(group.Privileges), 3)
1921-
}
1922-
}
1923-
})
19241901
}
19251902

19261903
func TestCore_BackupRBAC(t *testing.T) {

‎internal/rootcoord/show_collection_task.go

+5-2
Original file line numberDiff line numberDiff line change
@@ -88,12 +88,15 @@ func (t *showCollectionTask) Execute(ctx context.Context) error {
8888
}
8989
for _, entity := range entities {
9090
objectType := entity.GetObject().GetName()
91+
priv := entity.GetGrantor().GetPrivilege().GetName()
9192
if objectType == commonpb.ObjectType_Global.String() &&
92-
entity.GetGrantor().GetPrivilege().GetName() == util.PrivilegeNameForAPI(commonpb.ObjectPrivilege_PrivilegeAll.String()) {
93+
priv == util.PrivilegeNameForAPI(commonpb.ObjectPrivilege_PrivilegeAll.String()) {
9394
privilegeColls.Insert(util.AnyWord)
9495
return privilegeColls, nil
9596
}
96-
if objectType != commonpb.ObjectType_Collection.String() {
97+
// should list collection level built-in privilege group objects
98+
if objectType != commonpb.ObjectType_Collection.String() &&
99+
!Params.RbacConfig.IsCollectionPrivilegeGroup(priv) {
97100
continue
98101
}
99102
collectionName := entity.GetObjectName()

‎internal/rootcoord/show_collection_task_test.go

+51
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,57 @@ func TestShowCollectionsAuth(t *testing.T) {
325325
assert.Equal(t, "foo", task.Rsp.GetCollectionNames()[0])
326326
})
327327

328+
t.Run("collection level privilege group", func(t *testing.T) {
329+
Params.Save(Params.CommonCfg.AuthorizationEnabled.Key, "true")
330+
defer Params.Reset(Params.CommonCfg.AuthorizationEnabled.Key)
331+
meta := mockrootcoord.NewIMetaTable(t)
332+
core := newTestCore(withMeta(meta))
333+
334+
meta.EXPECT().SelectUser(mock.Anything, mock.Anything, mock.Anything).
335+
Return([]*milvuspb.UserResult{
336+
{
337+
User: &milvuspb.UserEntity{
338+
Name: "foo",
339+
},
340+
Roles: []*milvuspb.RoleEntity{
341+
{
342+
Name: "hoooo",
343+
},
344+
},
345+
},
346+
}, nil).Once()
347+
meta.EXPECT().SelectGrant(mock.Anything, mock.Anything).Return([]*milvuspb.GrantEntity{
348+
{
349+
Object: &milvuspb.ObjectEntity{Name: commonpb.ObjectType_Global.String()},
350+
Grantor: &milvuspb.GrantorEntity{
351+
Privilege: &milvuspb.PrivilegeEntity{
352+
Name: util.PrivilegeNameForAPI(commonpb.ObjectPrivilege_PrivilegeGroupCollectionReadOnly.String()),
353+
},
354+
},
355+
ObjectName: util.AnyWord,
356+
},
357+
}, nil).Once()
358+
meta.EXPECT().ListCollections(mock.Anything, mock.Anything, mock.Anything, mock.Anything).Return([]*model.Collection{
359+
{
360+
DBID: 1,
361+
CollectionID: 100,
362+
Name: "foo",
363+
CreateTime: tsoutil.GetCurrentTime(),
364+
},
365+
}, nil).Once()
366+
367+
task := &showCollectionTask{
368+
baseTask: newBaseTask(context.Background(), core),
369+
Req: &milvuspb.ShowCollectionsRequest{DbName: "default"},
370+
Rsp: &milvuspb.ShowCollectionsResponse{},
371+
}
372+
ctx := GetContext(context.Background(), "foo:root")
373+
err := task.Execute(ctx)
374+
assert.NoError(t, err)
375+
assert.Equal(t, 1, len(task.Rsp.GetCollectionNames()))
376+
assert.Equal(t, "foo", task.Rsp.GetCollectionNames()[0])
377+
})
378+
328379
t.Run("all collection", func(t *testing.T) {
329380
Params.Save(Params.CommonCfg.AuthorizationEnabled.Key, "true")
330381
defer Params.Reset(Params.CommonCfg.AuthorizationEnabled.Key)

‎pkg/util/constant.go

-95
Original file line numberDiff line numberDiff line change
@@ -290,101 +290,6 @@ var (
290290
commonpb.ObjectPrivilege_PrivilegeAlterDatabase.String(),
291291
commonpb.ObjectPrivilege_PrivilegeFlush.String(),
292292
}
293-
294-
BuiltinPrivilegeGroups = map[string][]string{
295-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupCollectionReadOnly.String()): CollectionReadOnlyPrivilegeGroup,
296-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupCollectionReadWrite.String()): CollectionReadWritePrivilegeGroup,
297-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupCollectionAdmin.String()): CollectionAdminPrivilegeGroup,
298-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupDatabaseReadOnly.String()): DatabaseReadOnlyPrivilegeGroup,
299-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupDatabaseReadWrite.String()): DatabaseReadWritePrivilegeGroup,
300-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupDatabaseAdmin.String()): DatabaseAdminPrivilegeGroup,
301-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupClusterReadOnly.String()): ClusterReadOnlyPrivilegeGroup,
302-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupClusterReadWrite.String()): ClusterReadWritePrivilegeGroup,
303-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGroupClusterAdmin.String()): ClusterAdminPrivilegeGroup,
304-
}
305-
306-
CollectionReadOnlyPrivilegeGroup = []string{
307-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeQuery.String()),
308-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeSearch.String()),
309-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeIndexDetail.String()),
310-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetFlushState.String()),
311-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetLoadState.String()),
312-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetLoadingProgress.String()),
313-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeHasPartition.String()),
314-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeShowPartitions.String()),
315-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeCollection.String()),
316-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeAlias.String()),
317-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeGetStatistics.String()),
318-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListAliases.String()),
319-
}
320-
321-
CollectionReadWritePrivilegeGroup = append(CollectionReadOnlyPrivilegeGroup,
322-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeLoad.String()),
323-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeRelease.String()),
324-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeInsert.String()),
325-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDelete.String()),
326-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeUpsert.String()),
327-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeImport.String()),
328-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeFlush.String()),
329-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCompaction.String()),
330-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeLoadBalance.String()),
331-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateIndex.String()),
332-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropIndex.String()),
333-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreatePartition.String()),
334-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropPartition.String()),
335-
)
336-
337-
CollectionAdminPrivilegeGroup = append(CollectionReadWritePrivilegeGroup,
338-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateAlias.String()),
339-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropAlias.String()),
340-
)
341-
342-
DatabaseReadOnlyPrivilegeGroup = []string{
343-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeShowCollections.String()),
344-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeDatabase.String()),
345-
}
346-
347-
DatabaseReadWritePrivilegeGroup = append(DatabaseReadOnlyPrivilegeGroup,
348-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeAlterDatabase.String()),
349-
)
350-
351-
DatabaseAdminPrivilegeGroup = append(DatabaseReadWritePrivilegeGroup,
352-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateCollection.String()),
353-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropCollection.String()),
354-
)
355-
356-
ClusterReadOnlyPrivilegeGroup = []string{
357-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListDatabases.String()),
358-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeSelectOwnership.String()),
359-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeSelectUser.String()),
360-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDescribeResourceGroup.String()),
361-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListResourceGroups.String()),
362-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeListPrivilegeGroups.String()),
363-
}
364-
365-
ClusterReadWritePrivilegeGroup = append(ClusterReadOnlyPrivilegeGroup,
366-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeFlushAll.String()),
367-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeTransferNode.String()),
368-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeTransferReplica.String()),
369-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeUpdateResourceGroups.String()),
370-
)
371-
372-
ClusterAdminPrivilegeGroup = append(ClusterReadWritePrivilegeGroup,
373-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeBackupRBAC.String()),
374-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeRestoreRBAC.String()),
375-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateDatabase.String()),
376-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropDatabase.String()),
377-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateOwnership.String()),
378-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropOwnership.String()),
379-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeManageOwnership.String()),
380-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreateResourceGroup.String()),
381-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropResourceGroup.String()),
382-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeUpdateUser.String()),
383-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeRenameCollection.String()),
384-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeCreatePrivilegeGroup.String()),
385-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeDropPrivilegeGroup.String()),
386-
MetaStore2API(commonpb.ObjectPrivilege_PrivilegeOperatePrivilegeGroup.String()),
387-
)
388293
)
389294

390295
// StringSet convert array to map for conveniently check if the array contains an element

‎pkg/util/paramtable/rbac_config_test.go

+30-11
Original file line numberDiff line numberDiff line change
@@ -20,22 +20,41 @@ import (
2020
"testing"
2121

2222
"github.com/stretchr/testify/assert"
23-
24-
"github.com/milvus-io/milvus/pkg/util"
2523
)
2624

2725
func TestRbacConfig_Init(t *testing.T) {
2826
params := ComponentParam{}
2927
params.Init(NewBaseTable(SkipRemote(true)))
3028
cfg := &params.RbacConfig
29+
assert.Equal(t, len(cfg.GetDefaultPrivilegeGroupNames()), 9)
30+
assert.True(t, cfg.IsCollectionPrivilegeGroup("CollectionReadOnly"))
31+
assert.False(t, cfg.IsCollectionPrivilegeGroup("DatabaseReadOnly"))
3132
assert.Equal(t, cfg.Enabled.GetAsBool(), false)
32-
assert.Equal(t, cfg.ClusterReadOnlyPrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["ClusterReadOnly"])
33-
assert.Equal(t, cfg.ClusterReadWritePrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["ClusterReadWrite"])
34-
assert.Equal(t, cfg.ClusterAdminPrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["ClusterAdmin"])
35-
assert.Equal(t, cfg.DBReadOnlyPrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["DatabaseReadOnly"])
36-
assert.Equal(t, cfg.DBReadWritePrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["DatabaseReadWrite"])
37-
assert.Equal(t, cfg.DBAdminPrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["DatabaseAdmin"])
38-
assert.Equal(t, cfg.CollectionReadOnlyPrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["CollectionReadOnly"])
39-
assert.Equal(t, cfg.CollectionReadWritePrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["CollectionReadWrite"])
40-
assert.Equal(t, cfg.CollectionAdminPrivileges.GetAsStrings(), util.BuiltinPrivilegeGroups["CollectionAdmin"])
33+
assert.Equal(t, cfg.ClusterReadOnlyPrivileges.GetAsStrings(), builtinPrivilegeGroups["ClusterReadOnly"])
34+
assert.Equal(t, cfg.ClusterReadWritePrivileges.GetAsStrings(), builtinPrivilegeGroups["ClusterReadWrite"])
35+
assert.Equal(t, cfg.ClusterAdminPrivileges.GetAsStrings(), builtinPrivilegeGroups["ClusterAdmin"])
36+
assert.Equal(t, cfg.DBReadOnlyPrivileges.GetAsStrings(), builtinPrivilegeGroups["DatabaseReadOnly"])
37+
assert.Equal(t, cfg.DBReadWritePrivileges.GetAsStrings(), builtinPrivilegeGroups["DatabaseReadWrite"])
38+
assert.Equal(t, cfg.DBAdminPrivileges.GetAsStrings(), builtinPrivilegeGroups["DatabaseAdmin"])
39+
assert.Equal(t, cfg.CollectionReadOnlyPrivileges.GetAsStrings(), builtinPrivilegeGroups["CollectionReadOnly"])
40+
assert.Equal(t, cfg.CollectionReadWritePrivileges.GetAsStrings(), builtinPrivilegeGroups["CollectionReadWrite"])
41+
assert.Equal(t, cfg.CollectionAdminPrivileges.GetAsStrings(), builtinPrivilegeGroups["CollectionAdmin"])
42+
}
43+
44+
func TestRbacConfig_Override(t *testing.T) {
45+
params := ComponentParam{}
46+
params.Init(NewBaseTable(SkipRemote(true)))
47+
48+
clusterReadWrite := `SelectOwnership,SelectUser,DescribeResourceGroup`
49+
50+
params.Save(params.RbacConfig.Enabled.Key, "true")
51+
params.Save(params.RbacConfig.ClusterReadWritePrivileges.Key, clusterReadWrite)
52+
53+
defer func() {
54+
params.Reset(params.RbacConfig.Enabled.Key)
55+
params.Reset(params.RbacConfig.ClusterReadWritePrivileges.Key)
56+
}()
57+
58+
group := params.RbacConfig.GetDefaultPrivilegeGroup("ClusterReadWrite")
59+
assert.Equal(t, len(group.Privileges), 3)
4160
}

0 commit comments

Comments
 (0)