Add option to enable/disable netapi clients #63050
Conversation
|
@barneysowood can we close #59622 in favor of this one? |
|
I'm thinking we should also add some docs in the main salt-api docs since this will be required for all users to use any client |
Done. |
barneysowood
force-pushed
the
default-disable-salt-api-clients
branch
from
7d78804
to
5119c57
Compare
Added some docs in the netapi reference |
barneysowood
force-pushed
the
default-disable-salt-api-clients
branch
from
14a7642
to
e25f612
Compare
|
re-run pr-macosx-catalina-x86_64-py3-pytest |
|
I'm also wondering if we should spin off 1-2 new issues to capture some chores related to this PR:
I can spin up those issues if needed tomorrow. |
@barbaricyawps - that sounds like a good idea. Feel free to pass either or both of those to me. I'll probably need to discuss with you where best to create the more in-depth docs (in the general docs or perhaps the userguide, or somewhere else) |
Adds an option to allow you to enable clients (eg ssh, wheel) in the netapi. By default all clients will be disabled. Does the check before any attempts to authenticate.
Adds pytest based integration tests as the old non-pytest netapi/test_client.py tests have been removed.
Adds documentation for netapi_enable_clients to the netapi reference documentation.
Enables local and runner clients for rest_cherrypy tests
Enables local, local_async, runner and runner_async clients for rest_tornado tests
Updates changelog entry for netapi_enable_clients options to be a "changed" rather than "added" changelog entry as it will require users to update their master config. Expands on explanation of change to make clear what will happen.
Updates the error message returned to explain how to enable a disabled netapi client.
Adds information on the netapi_enable_clients changes to the 3006 release document.
barneysowood
force-pushed
the
default-disable-salt-api-clients
branch
from
e25f612
to
896a7ad
Compare
@Ch3LL - I've done that and added the other requested changes. Let me know if you're happy with those. |
|
@barbaricyawps looks like @barneysowood added docs to the release notes and docs have been added for salt-api. Are you okay with the changes @barbaricyawps ? |
What does this PR do?
Adds a new config option "netapi_enable_clients" that takes a list of clients to enable in the netapi.
Checks the list early in handling the the request before authentication occurs. Should be useful where certain clients (eg ssh or wheel) aren't required and should be disabled to reduce attack surface in the salt-api.
This PR is an alternative to #59622 which implements @dwoz's suggestion in #59622 (review) to make client disabled by default and require them to be specifically enabled in the master config.
New Behavior
Adds "netapi_enable_clients" list option to the config which is checked when a request is passed to NetApiClient.run() and an exception raised if the requested client is not in the list.
Merge requirements satisfied?
[NOTICE] Bug fixes or features added to Salt require tests.
Commits signed with GPG?
No