XML

Word

Printable

Epic Name:
Add Authorization to internal Components of Agent Installer
Work Type:
BU Product Work
Blocked:
False
Blocked Reason:

Hide

None

Show
None
Ready:
False
Color Status:
Green
Epic Status:
In Progress
Feature Link:
OCPSTRAT-1571 - Add Authorization to internal Components of Agent-Based Installer
Parent Link:
OCPSTRAT-1571Add Authorization to internal Components of Agent-Based Installer
Hierarchy Progress Bar:

44% To Do, 33% In Progress, 22% Done
Status Summary:

Hide

16 Oct 2024: Green

2 PRs are up for review. First we need the swagger changes from assisted service to be merged and then implement the authz handler. The last PR to create 3 seperate tokens is already in code review.

Show
16 Oct 2024: Green 2 PRs are up for review. First we need the swagger changes from assisted service to be merged and then implement the authz handler. The last PR to create 3 seperate tokens is already in code review.
Target Version:

openshift-4.18

Sprint:
Installer (PB) Sprint 258, Installer (PB) Sprint 259, Installer Sprint 260, Installer Sprint 261

Epic Goal

Implement authorization to secure API access for different user personas/actors in the agent-based installer.
User Personas:
- Read-Only Access: For "wait-for" and "monitor-add-nodes" commands.
- Read-Write Access: For systemd services and the agent service.

Why is this important?

The agent-based installer APIs have implemented basic security measures through authentication, as covered in ~~AGENT-145~~. To further enhance security, it is crucial to implement user persona/actor-based authorization, allowing for differentiated access control, such as read-only or read-write permissions, based on the user's role. This approach will provide a more robust and secure API framework, ensuring that users can only perform actions appropriate to their role.

Users running the wait-for or monitor-add-nodes commands should have read-only permissions. They should not be able to write to the API. If they attempt to perform write operations, appropriate error messages could be displayed, indicating that they are not authorized to write.
Users associated with running systemd services should have both read and write permissions.
Users associated with running the agent service should also have read and write permissions.

CI - MUST be running successfully with tests automated
Release Technical Enablement - Provide necessary release enablement details and documents.
...

CI - CI is running, tests are automated and merged.
Release Enablement <link to Feature Enablement Presentation>
DEV - Upstream code and tests merged: <link to meaningful PR or GitHub Issue>
DEV - Upstream documentation merged: <link to meaningful PR or GitHub Issue>
DEV - Downstream build attached to advisory: <link to errata>
QE - Test plans in Polarion: <link or reference to Polarion>
QE - Automated tests merged: <link or reference to automated tests>
DOC - Downstream documentation merged: <link to meaningful PR>

is blocked by

AGENT-145 Add Authentication to internal Components of Agent Installer