Net 5875 - Create the Exported Services Resources

agent/consul/type_registry.go

@@ -7,6 +7,7 @@ import (
 	"github.com/hashicorp/consul/internal/auth"
 	"github.com/hashicorp/consul/internal/catalog"
 	"github.com/hashicorp/consul/internal/mesh"
+	"github.com/hashicorp/consul/internal/multicluster"
 	"github.com/hashicorp/consul/internal/resource"
 	"github.com/hashicorp/consul/internal/resource/demo"
 	"github.com/hashicorp/consul/internal/tenancy"
@@ -27,6 +28,7 @@ func NewTypeRegistry() resource.Registry {
 	catalog.RegisterTypes(registry)
 	auth.RegisterTypes(registry)
 	tenancy.RegisterTypes(registry)
+	multicluster.RegisterTypes(registry)
 
 	return registry
 }

internal/multicluster/exports.go

@@ -0,0 +1,22 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package multicluster
+
+import (
+	"github.com/hashicorp/consul/internal/multicluster/internal/types"
+	"github.com/hashicorp/consul/internal/resource"
+)
+
+var (
+	// API Group Information
+	APIGroup        = types.GroupName
+	VersionV1Alpha1 = types.VersionV1Alpha1
+	CurrentVersion  = types.CurrentVersion
+)
+
+// RegisterTypes adds all resource types within the "multicluster" API group
+// to the given type registry
+func RegisterTypes(r resource.Registry) {
+	types.Register(r)
+}

internal/multicluster/internal/types/computed_exported_services.go

@@ -0,0 +1,44 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package types
+
+import (
+	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/internal/resource"
+	pbmulticluster "github.com/hashicorp/consul/proto-public/pbmulticluster/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+const (
+	ComputedExportedServicesName = "global"
+)
+
+func RegisterComputedExportedServices(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     pbmulticluster.ComputedExportedServicesType,
+		Proto:    &pbmulticluster.ComputedExportedServices{},
+		Scope:    resource.ScopePartition,
+		Mutate:   MutateComputedExportedServices,
+		Validate: ValidateComputedExportedServices,
+		ACLs: &resource.ACLHooks{
+			Read:  aclReadHookComputedExportedServices,
+			Write: aclWriteHookComputedExportedServices,
+			List:  aclListHookComputedExportedServices,
+		},
+	})
+}
+
+func aclReadHookComputedExportedServices(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext, id *pbresource.ID, _ *pbresource.Resource) error {
+	return authorizer.ToAllowAuthorizer().MeshReadAllowed(authzContext)
+}
+
+func aclWriteHookComputedExportedServices(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext, res *pbresource.Resource) error {
+	return authorizer.ToAllowAuthorizer().MeshWriteAllowed(authzContext)
+}
+
+func aclListHookComputedExportedServices(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext) error {
+	// No-op List permission as we want to default to filtering resources
+	// from the list using the Read enforcement.
+	return nil
+}

internal/multicluster/internal/types/computed_exported_services_ce_test.go

@@ -0,0 +1,45 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+//go:build !consulent
+// +build !consulent
+
+package types
+
+import (
+	multiclusterv1alpha1 "github.com/hashicorp/consul/proto-public/pbmulticluster/v1alpha1"
+)
+
+func validComputedExportedServicesWithPeer() *multiclusterv1alpha1.ComputedExportedServices {
+	consumers := []*multiclusterv1alpha1.ComputedExportedService{
+		{
+			Consumers: []*multiclusterv1alpha1.ComputedExportedServicesConsumer{
+				{
+					ConsumerTenancy: &multiclusterv1alpha1.ComputedExportedServicesConsumer_Peer{
+						Peer: "",
+					},
+				},
+			},
+		},
+	}
+	return &multiclusterv1alpha1.ComputedExportedServices{
+		Consumers: consumers,
+	}
+}
+
+func validComputedExportedServicesWithPartition() *multiclusterv1alpha1.ComputedExportedServices {
+	consumers := []*multiclusterv1alpha1.ComputedExportedService{
+		{
+			Consumers: []*multiclusterv1alpha1.ComputedExportedServicesConsumer{
+				{
+					ConsumerTenancy: &multiclusterv1alpha1.ComputedExportedServicesConsumer_Partition{
+						Partition: "default",
+					},
+				},
+			},
+		},
+	}
+	return &multiclusterv1alpha1.ComputedExportedServices{
+		Consumers: consumers,
+	}
+}

internal/multicluster/internal/types/computed_exported_services_test.go

@@ -0,0 +1,151 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package types
+
+import (
+	"errors"
+	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/agent/structs"
+	"github.com/hashicorp/consul/internal/resource"
+	"github.com/hashicorp/consul/internal/resource/resourcetest"
+	multiclusterv1alpha1 "github.com/hashicorp/consul/proto-public/pbmulticluster/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+	"github.com/stretchr/testify/require"
+	"testing"
+)
+
+func TestComputedExportedServicesValidations(t *testing.T) {
+	type testcase struct {
+		Resource *pbresource.Resource
+	}
+	run := func(t *testing.T, tc testcase) {
+		err := ValidateComputedExportedServices(tc.Resource)
+		require.NoError(t, err)
+	}
+
+	cases := map[string]testcase{
+		"computed exported services with peer": {
+			Resource: resourcetest.Resource(multiclusterv1alpha1.ComputedExportedServicesType, ComputedExportedServicesName).
+				WithData(t, validComputedExportedServicesWithPeer()).
+				Build(),
+		},
+		"computed exported services with partition": {
+			Resource: resourcetest.Resource(multiclusterv1alpha1.ComputedExportedServicesType, ComputedExportedServicesName).
+				WithData(t, validComputedExportedServicesWithPartition()).
+				Build(),
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}
+
+func TestComputedExportedServicesValidations_InvalidName(t *testing.T) {
+	res := resourcetest.Resource(multiclusterv1alpha1.ComputedExportedServicesType, "computed-exported-services").
+		WithData(t, validComputedExportedServicesWithPeer()).
+		Build()
+
+	err := ValidateComputedExportedServices(res)
+	require.Error(t, err)
+	expectedError := errors.New("invalid \"name\" field: name can only be \"global\"")
+	require.ErrorAs(t, err, &expectedError)
+}
+
+func TestComputedExportedServicesACLs(t *testing.T) {
+	// Wire up a registry to generically invoke hooks
+	registry := resource.NewRegistry()
+	Register(registry)
+
+	type testcase struct {
+		rules   string
+		check   func(t *testing.T, authz acl.Authorizer, res *pbresource.Resource)
+		readOK  string
+		writeOK string
+		listOK  string
+	}
+
+	const (
+		DENY    = "deny"
+		ALLOW   = "allow"
+		DEFAULT = "default"
+	)
+
+	checkF := func(t *testing.T, expect string, got error) {
+		switch expect {
+		case ALLOW:
+			if acl.IsErrPermissionDenied(got) {
+				t.Fatal("should be allowed")
+			}
+		case DENY:
+			if !acl.IsErrPermissionDenied(got) {
+				t.Fatal("should be denied")
+			}
+		case DEFAULT:
+			require.Nil(t, got, "expected fallthrough decision")
+		default:
+			t.Fatalf("unexpected expectation: %q", expect)
+		}
+	}
+
+	reg, ok := registry.Resolve(multiclusterv1alpha1.ComputedExportedServicesType)
+	require.True(t, ok)
+
+	run := func(t *testing.T, tc testcase) {
+		exportedServiceData := &multiclusterv1alpha1.ComputedExportedServices{}
+		res := resourcetest.Resource(multiclusterv1alpha1.ComputedExportedServicesType, "global").
+			WithData(t, exportedServiceData).
+			Build()
+		resourcetest.ValidateAndNormalize(t, registry, res)
+
+		config := acl.Config{
+			WildcardName: structs.WildcardSpecifier,
+		}
+		authz, err := acl.NewAuthorizerFromRules(tc.rules, &config, nil)
+		require.NoError(t, err)
+		authz = acl.NewChainedAuthorizer([]acl.Authorizer{authz, acl.DenyAll()})
+
+		t.Run("read", func(t *testing.T) {
+			err := reg.ACLs.Read(authz, &acl.AuthorizerContext{}, res.Id, res)
+			checkF(t, tc.readOK, err)
+		})
+		t.Run("write", func(t *testing.T) {
+			err := reg.ACLs.Write(authz, &acl.AuthorizerContext{}, res)
+			checkF(t, tc.writeOK, err)
+		})
+		t.Run("list", func(t *testing.T) {
+			err := reg.ACLs.List(authz, &acl.AuthorizerContext{})
+			checkF(t, tc.listOK, err)
+		})
+	}
+
+	cases := map[string]testcase{
+		"no rules": {
+			rules:   ``,
+			readOK:  DENY,
+			writeOK: DENY,
+			listOK:  DEFAULT,
+		},
+		"mesh read policy": {
+			rules:   `mesh = "read"`,
+			readOK:  ALLOW,
+			writeOK: DENY,
+			listOK:  DEFAULT,
+		},
+		"mesh write policy": {
+			rules:   `mesh = "write"`,
+			readOK:  ALLOW,
+			writeOK: ALLOW,
+			listOK:  ALLOW,
+		},
+	}
+
+	for name, tc := range cases {
+		t.Run(name, func(t *testing.T) {
+			run(t, tc)
+		})
+	}
+}

internal/multicluster/internal/types/exported_services.go

@@ -0,0 +1,62 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package types
+
+import (
+	"github.com/hashicorp/consul/acl"
+	"github.com/hashicorp/consul/internal/resource"
+	pbmulticluster "github.com/hashicorp/consul/proto-public/pbmulticluster/v1alpha1"
+	"github.com/hashicorp/consul/proto-public/pbresource"
+)
+
+func RegisterExportedServices(r resource.Registry) {
+	r.Register(resource.Registration{
+		Type:     pbmulticluster.ExportedServicesType,
+		Proto:    &pbmulticluster.ExportedServices{},
+		Scope:    resource.ScopeNamespace,
+		Mutate:   MutateExportedServices,
+		Validate: ValidateExportedServices,
+		ACLs: &resource.ACLHooks{
+			Read:  aclReadHookExportedServices,
+			Write: aclWriteHookExportedServices,
+			List:  aclListHookExportedServices,
+		},
+	})
+}
+
+func aclReadHookExportedServices(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext, _ *pbresource.ID, res *pbresource.Resource) error {
+	var exportedService pbmulticluster.ExportedServices
+
+	if err := res.Data.UnmarshalTo(&exportedService); err != nil {
+		return resource.NewErrDataParse(&exportedService, err)
+	}
+
+	for _, serviceName := range exportedService.Services {
+		if err := authorizer.ToAllowAuthorizer().ServiceReadAllowed(serviceName, authzContext); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func aclWriteHookExportedServices(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext, res *pbresource.Resource) error {
+	var exportedService pbmulticluster.ExportedServices
+
+	if err := res.Data.UnmarshalTo(&exportedService); err != nil {
+		return resource.NewErrDataParse(&exportedService, err)
+	}
+
+	for _, serviceName := range exportedService.Services {
+		if err := authorizer.ToAllowAuthorizer().ServiceWriteAllowed(serviceName, authzContext); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func aclListHookExportedServices(authorizer acl.Authorizer, authzContext *acl.AuthorizerContext) error {
+	// No-op List permission as we want to default to filtering resources
+	// from the list using the Read enforcement.
+	return nil
+}