Key/value pair metadata authentication for declarative process orchestration environments
An access control process executing in a declarative container orchestration system receives a notification that the declarative container orchestration system has received a configuration file that identifies a desired future state that includes a creation of an object. Prior to allowing the declarative container orchestration system to create the object, the configuration file is analyzed. Based on the analysis, it is determined that the configuration file includes a key/value pair that is to be associated with the object. The access control process determines that a user associated with the configuration file lacks authorization to request the key/value pair. In response to determining that the user associated with the configuration file lacks authorization to request the key/value pair, the declarative container orchestration system is prevented from creating the desired future state identified in the configuration file.
1. A method comprising:
receiving, by an access control process executing in a declarative container orchestration system, a first notification that the declarative container orchestration system has received a configuration file that identifies a desired future state that includes a creation of an object;
prior to allowing the declarative container orchestration system to create the object, analyzing the configuration file;
based on the analysis, determining that the configuration file includes a key/value pair that is to be associated with the object;
determining, by the access control process that a user associated with the configuration file lacks authorization to request the key/value pair; and
in response to determining that the user associated with the configuration file lacks authorization to request the key/value pair, preventing the declarative container orchestration system from creating the desired future state identified in the configuration file.
2. The method of claim 1 wherein the declarative container orchestration system comprises a cluster of nodes, and wherein the declarative container orchestration system is operable to implement a desired future state one or more nodes of the cluster of nodes.
3. The method of claim 1 wherein determining, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair further comprises:
determining the user associated with the configuration file; and
accessing access control permissions structure that identifies users and key/value pairs the users are authorized to use.
4. The method of claim 3 wherein determining, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair further comprises determining, based on the access control permissions structure, that the user is authorized to use the key but not the value.
5. The method of claim 3 wherein determining, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair further comprises determining, based on the access control permissions structure, that the user is not authorized to use the key.
6. The method of claim 1 wherein the declarative container orchestration system comprises a Kubernetes-based container orchestration system.
7. The method of claim 1 further comprising:
receiving, by the access control process, a second notification that the declarative container orchestration system has received a configuration file that identifies a desired future state that includes a creation of an object;
prior to allowing the declarative container orchestration system to create the object, analyzing the configuration file;
based on the analysis, determining that the configuration file includes a key/value pair that is to be associated with the object;
determining, by the access control process that a user associated with the configuration file has authorization to request the key/value pair; and
in response to determining that the user associated with the configuration file lacks authorization to request the key/value pair, allowing the declarative container orchestration system to create the desired future state identified in the configuration file.
8. A computing device, comprising:
a memory; and
a processor device coupled to the memory to:
receive, by an access control process executing in a declarative container orchestration system, notification that the declarative container orchestration system has received a configuration file that identifies a desired future state that includes a creation of an object;
prior to allowing the declarative container orchestration system to create the object, analyze the configuration file;
based on the analysis, determine that the configuration file includes a key/value pair that is to be associated with the object;
determine, by the access control process that a user associated with the configuration file lacks authorization to request the key/value pair; and
prevent the declarative container orchestration system from creating the desired future state identified in the configuration file.
9. The computing device of claim 8 wherein the declarative container orchestration system comprises a cluster of nodes, and wherein the declarative container orchestration system is operable to implement a desired future state one or more nodes of the cluster of nodes.
10. The computing device of claim 8 wherein to determine, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair, the processor device is further to:
determine the user associated with the configuration file; and
access an access control permissions structure that identifies users and key/value pairs the users are authorized to use.
11. The computing device of claim 10 wherein to determine, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair, the processor device is further to determine, based on the access control permissions structure, that the user is authorized to use the key but not the value.
12. The computing device of claim 10 wherein to determine, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair further, the processor device is further to determine, based on the access control permissions structure, that the user is not authorized to use the key.
13. The computing device of claim 10 wherein the declarative container orchestration system comprises a Kubernetes-based container orchestration system.
14. The computing device of claim 10 wherein the processor device is further to:
receive, by the access control process, a second notification that the declarative container orchestration system has received a configuration file that identifies a desired future state that includes a creation of an object;
prior to allowing the declarative container orchestration system to create the object, analyze the configuration file;
based on the analysis, determine that the configuration file includes a key/value pair that is to be associated with the object;
determine, by the access control process that a user associated with the configuration file has authorization to request the key/value pair; and
in response to determining that the user associated with the configuration file lacks authorization to request the key/value pair, allow the declarative container orchestration system to create the desired future state identified in the configuration file.
15. A non-transitory computer-readable storage medium that includes executable instructions to cause a processor device to:
receive, by an access control process executing in a declarative container orchestration system, notification that the declarative container orchestration system has received a configuration file that identifies a desired future state that includes a creation of an object;
prior to allowing the declarative container orchestration system to create the object, analyze the configuration file;
based on the analysis, determine that the configuration file includes a key/value pair that is to be associated with the object;
determine, by the access control process that a user associated with the configuration file lacks authorization to request the key/value pair; and
prevent the declarative container orchestration system from creating the desired future state identified in the configuration file.
16. The non-transitory computer-readable storage medium of claim 15 wherein the declarative container orchestration system comprises a cluster of nodes, and wherein the declarative container orchestration system is operable to implement a desired future state one or more nodes of the cluster of nodes.
17. The non-transitory computer-readable storage medium of claim 15 wherein to determine, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair, the instructions further cause the processor device to:
determine the user associated with the configuration file; and
access an access control permissions structure that identifies users and key/value pairs the users are authorized to use.
18. The non-transitory computer-readable storage medium of claim 17 wherein to determine, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair, the instructions further cause the processor device to determine, based on the access control permissions structure, that the user is authorized to use the key but not the value.
19. The non-transitory computer-readable storage medium of claim 17 wherein to determine, by the access control process that the user associated with the configuration file lacks authorization to request the key/value pair further, the instructions further cause the processor device to, based on the access control permissions structure, that the user is not authorized to use the key.
20. The non-transitory computer-readable storage medium of claim 15 wherein the declarative container orchestration system comprises a Kubernetes-based container orchestration system.