Repository navigation
Conversation
…ciler
Every integration's Agents tab, and each agent's own Access tab, now turns an
agent on or off at a vendor and sets its access in that vendor's own terms:
Datadog roles, GitHub App permissions, GitLab roles, Jira project roles,
Confluence space roles or permissions, Slack's app, Mattermost role sets. The
reconciler applies the setting at the vendor and keeps it there.
- One seat path: each vendor's company pass does company-level work only, and
every agent account is created, changed, turned off, removed or rotated by
one plan and one sync (internal/seataccess), from one ledger of the accounts
the engine owns on the fleet's coordination store. Off disables and keeps an
account; Remove is a separate, confirmed action. Access changed by hand at a
vendor is restored and reported; an account a person turned off is never
turned back on unasked.
- Engine-owned credentials: a seat's credential lives under a name the engine
derives, sealed only by the engine, and bound to the agent's tool by the
server's seat_credentials or a recognised default. A credential handed in
from outside Crewlet stays an exclusive ${VAR} the engine never writes. The
document refuses a seat credential shared with a company setting or another
seat, which is the shape of the Datadog key incident.
- Safety: nothing is taken from an account the ledger does not record; an
existing account is adopted, never duplicated; a credential that fails to
record is revoked; a company credential that may hold an agent's value holds
every retiring step until it is replaced; a raise to an administration grant,
including one an integration starting to be provisioned would make, needs a
person present at a fresh step-up, and fails closed when a vendor's levels
cannot be read.
- API: GET, plan, PUT and seat actions under /setup/integrations/{kind}/access,
a Slack install link minted on request and completed by the engine, the
Dashboard Assistant's set_seat_access tool, and operator-managed documents
answered read-only.
- Migration: on first start each integration moves onto per-seat access in one
revision, gated per kind so an unmigrated kind is never read as all off;
existing accounts keep their observed role and are recorded in the ledger.
- Retired: the company-wide Datadog role, GitLab access levels and token
scopes, the GitHub access tiers, Mattermost's singular channel, and the
crewlet gitlab, mattermost and slack provision seat paths.
- Dashboard: the Agents tab on uilet 0.79.0's DataTable and SelectionBar, the
agent page's Access tab, and the integration pane's Check now in the tab
row.
Signed-off-by: pinotelio <ahmadreza.mollapour@gmail.com>
Contributor
Author
|
Duplicate of #478, whose branch now carries the same signed-off commit. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Per-agent integration access managed by the reconciler: each integration's Agents tab (and each agent's Access tab) turns an agent on or off at a vendor and sets its access in the vendor's own terms, and the reconciler applies and keeps it.
This is the work reviewed on #478, published as one signed-off commit with an identical tree, because #478 carried commits without a Signed-off-by trailer and the sign-off check judges every commit a branch adds.
What it does
/setup/integrations/{kind}/access, a Slack install link completed by the engine, the Dashboard Assistant'sset_seat_access, operator-managed documents read-only.crewlet gitlab|mattermost|slack provisionseat paths.Review
Three independent reviews (engine core, vendors, dashboard and operator) and a re-review; every blocker and major they raised is fixed with a test. main (#475, #142 and the rest) is merged in.
Companion
crewlet/crewlet-operator#51 renders the per-seat schema; it merges after this.