Access control in a decentralized control plane of a computing system
A method of controlling access to a target resource of a plurality of resources managed by a control plane executing on a computing system includes: receiving, at the control plane, a request for the target resource by a client, the request including a user indicator; identifying a user group in which the user indicator is a member; identifying a role that includes an access policy, applicable to the user group, for accessing a group of the plurality of resources, the group of resources defined by a query executable against an index of states of the plurality of resources; obtaining a state of the target resource in response to the request; and applying the access policy of the role to the request for the target resource based on a determination of whether the state of the target resource satisfies a query filter corresponding to the query of the role.
1. A method of controlling access to a target resource of a plurality of resources managed by a control plane executing on a computing system, the method comprising:
receiving, at the control plane, a request for the target resource by a client, the request including a user indicator;
identifying a user group in which the user indicator is a member, the user group defined by a first query executable against an index of states of the plurality of resources;
identifying a role that includes an access policy, applicable to the user group, for accessing a group of the plurality of resources, the role including a uniform resource indicator (URI) of a user group service of the control plane and a URI of a resource group service of the control plane, the group of resources defined by a second query executable against the index of states of the plurality of resources;
obtaining a state of the target resource in response to the request, a state of the user group service, which includes the first query, and a state of the resource group service, which includes the second query; and
applying the access policy of the role to the request for the target resource based on a determination of whether the state of the target resource satisfies a query filter corresponding to the query of the role.
2. The method of claim 1 , wherein the request includes a token, the token encoding the user indicator, an expiration time, and a signature, and wherein the method further comprises parsing the token to verify the signature of the token, verify the expiration time against a current time, and extract the user indicator.
3. The method of claim 1 , wherein the user indicator comprises a uniform resource indicator (URI) of a user service of the control plane, a state of the user service including a user identity.
4. The method of claim 1 , wherein the URI of the user group service, the URI of the resource group service, and the access policy comprises state of a role service of the control plane.
5. The method of claim 1 , wherein the access policy of the role includes permission to invoke one or more actions of a representation state transfer (REST) application programming interface (API) of the control plane.
6. The method of claim 1 , wherein the step of applying the access policy comprises:
determining that the state of the resource satisfies the second query and that an action of the request satisfies the access policy; and
forwarding the request to the resource for handling the action of the request.
7. The method of claim 1 , wherein the step of applying the access policy comprises:
determining that the state of the resource does not satisfy the second query; and
generating a response to the request that indicates the request is forbidden.
8. The method of claim 1 , wherein the plurality of resources comprise a plurality of services managed by the control plane.
9. A computer system, comprising:
a hardware platform having a processor and memory;
a software platform executing on the hardware platform;
a service host process executing within the software platform, the service host process including a framework that controls access to a target resource of a plurality of resources, the service host process configured to:
receive a request for the target resource by a client, the request including a user indicator;
identify a user group in which the user indicator is a member, the user group defined by a first query executable against an index of states of the plurality of resources;
identify a role that includes an access policy, applicable to the user group, for accessing a group of the plurality of resources, the role including a uniform resource indicator (URI) of a user group service of the control plane and a URI of a resource group service of the control plane, the group of resources defined by a second query executable against the index of states of the plurality of resources;
obtain a state of the target resource in response to the request, a state of the user group service, which includes the first query, and a state of the resource group service, which includes the second query; and
apply the access policy of the role to the request for the target resource based on a determination of whether the state of the target resource satisfies a query filter corresponding to the query of the role.
10. The computer system of claim 9 , wherein the request includes a token, the token encoding the user indicator, an expiration time, and a signature, and wherein the method further comprises parsing the token to verify the signature of the token, verify the expiration time against a current time, and extract the user indicator.
11. The computer system of claim 9 , wherein the user indicator comprises a uniform resource indicator (URI) of a user service of the framework, a state of the user service including a user identity.
12. The computer system of claim 9 , wherein the URI of the user group service, the URI of the resource group service, and the access policy comprises state of a role service of the framework.
13. The computer system of claim 9 , wherein the access policy of the role includes permission to invoke one or more actions of a representation state transfer (REST) application programming interface (API) of the framework.
14. The computer system of claim 9 , wherein the plurality of resources comprise a plurality of services managed by the framework.
15. A non-transitory computer readable medium comprising instructions, which when executed in a computer system, causes the computer system to carry out a method of controlling access to a target resource of a plurality of resources managed by a control plane executing on a computing system, the method comprising:
receiving, at the control plane, a request for the target resource by a client, the request including a user indicator;
identifying a user group in which the user indicator is a member, the user group defined by a first query executable against an index of states of the plurality of resources;
identifying a role that includes an access policy, applicable to the user group, for accessing a group of the plurality of resources, the role including a uniform resource indicator (URI) of a user group service of the control plane and a URI of a resource group service of the control plane, the group of resources defined by a second query executable against the index of states of the plurality of resources;
obtaining a state of the target resource in response to the request, a state of the user group service, which includes the first query, and a state of the resource group service, which includes the second query; and
applying the access policy of the role to the request for the target resource based on a determination of whether the state of the target resource satisfies a query filter corresponding to the query of the role.
16. The non-transitory computer readable medium of claim 15 , wherein the plurality of resources comprise a plurality of services managed by the control plane.