OP-16464: integrate pipeline trigger to verify fiat permissions #66
Conversation
| @@ -272,7 +272,7 @@ class PipelineController { | |||
| } | |||
|
|
|||
| @Operation(summary = "Trigger a pipeline execution") | |||
| @PreAuthorize("hasPermission(#application, 'APPLICATION', 'EXECUTE')") | |||
| @PreAuthorize("hasPermission(#application, 'APPLICATION', 'EXECUTE') && hasPermission(#pipelineNameOrId, 'PIPELINE', 'EXECUTE')") | |||
There was a problem hiding this comment.
can u pls explain why we made this change ?
There was a problem hiding this comment.
If we enable the Pipeline RBAC before trigger pipeline to verify the permissions against with fiat
There was a problem hiding this comment.
- oss dont hav pipeline level rbac, only oes hav ?
- If yes, then why only selected controller, not other controllers as well?
- If someone gave execute access for some pipeline but not to application, is this scenario possible?
There was a problem hiding this comment.
oes only will have these customization pipeline rbac.
Pipeline trigger will from gate to echo and to orca. remain verification have in orca and front50.
first priority Application level and then Pipeline.
This feature is requested by customer WU and currently using this feature.
There was a problem hiding this comment.
in a call, @sudhakaropsmx mentioned that other checks r implemented in other services like orca.
still, i hav one doubt, for few controllers we r allowing access from gate to orca & checking in orca for rbac.
but for some controllers, we r checking rbac in gate itself, any particular reason ?
-> but as this is not a blocker, approving the PR.
sudhakaropsmx
changed the title
sudhakaropsmx
force-pushed
the
Bugfix/OP-18094_Pipeline_permissions
branch
from
8a9f715 to
63491bf
Compare
https://devopsmx.atlassian.net/browse/OP-16464
Pipeline RBAC implementation commits have ORCA, Front50, and Fiat, Gate is missing implementation.
As part of the Pipeline RBAC implementation these changes required before trigger pipeline to verify the permissions against with fiat
OpsMx#279