Possibility to set up ACLs for the tables about vitess-operator

[enisoc]

This is possible, although it isn't documented. You can follow the Vitess docs and inject the config in each tablet pool like this:

tabletPools:
- cell: cell1
  type: replica
  extraVolumes:
  - [k8s volume definition to mount ACL config file]
  extraVolumeMounts:
  - [k8s volume mount definition to add to each container]
  vttablet:
    extraFlags:
      [flags to configure ACLs]

[maZahaca]

Thank you, I will try it in a meanwhile. Closing now.

[jmccoy555]

Hi, is this still valid as it does not appear to be working for me.

keyspaces:
  - name: commerce
    turndownPolicy: Immediate
    partitionings:
    - equal:
        parts: 1
        shardTemplate:
          databaseInitScriptSecret:
            name: example-cluster-config
            key: init_db.sql
          replication:
            enforceSemiSync: false
          tabletPools:
          - cell: zone1
            type: replica
            replicas: 2
            extraVolumes:
            - name: acl-commerce
              configMap:
                name: acl-commerce
            extraVolumeMounts:
            - name: acl-commerce
              mountPath: /mnt 
            vttablet:
              extraFlags:
                db_charset: utf8mb4
                enforce-tableacl-config: "true" 
                queryserver-config-strict-table-acl: "true"
                table-acl-config: /mnt/acl-commerce.json 
                table-acl-config-reload-interval: 5m            
              resources:
                requests:
                  cpu: 100m
                  memory: 256Mi
            mysqld:
              resources:
                requests:
                  cpu: 100m
                  memory: 256Mi
            dataVolumeClaimTemplate:
              accessModes: ["ReadWriteOnce"]
              resources:
                requests:
                  storage: 10Gi

File created within the tablet pod by the configmap. Output of cat /mnt/acl-commerce.json

{
    "table_groups": [
    {
        "name": "commerce",
        "table_names_or_prefixes": ["%"],
        "readers": ["user", "commerce"],
        "writers": ["user", "commerce"],
        "admins": ["user", "commerce"]
    }            
  ]
}

The commerce database is still visible to all users.

I've opened a terminal into the tablet pod and checked the contents of acl-commerce.json and it matches the above which is based upon the example.

Changing the value of table-acl-config: /mnt/acl-commerce.json to a non existing file results in an error due to the enforce-tableacl-config: "true" so that is working correctly.

I've recreated the pods but it is still not having an effect., and set table-acl-config-reload-interval: 5m (not sure if the units are correct as it's not documented?? ) to make sure it reloads., but still no change.

Hopefully I'm missing something silly 🤦

Thanks.

[shilp-gupta]

You seem to be duplicating the vttablet. Also, the config map needs to have a key "acl-commerce.json" with value equal to the actual string.

[jmccoy555]

Hi @shilp-gupta thanks for the reply. I'm finding it a bit of a mine field trying to piece all this together. Good spot with the duplicate, that was just an error pasting into to here though, no idea how I managed that. Updated now.

So the above is the contents of the file when I cat /mnt/acl-commerce.json from within the pod, which I was checking was created correctly and looks like the example to me. Probably could have explained that better above. Updated that too.

The actual configmap as viewed in the kubernetes web interface is

{
	"acl-commerce.json": "{\r
		  \"table_groups\": [\r
		    {\r
		      \"name\": \"commerce\",\r
		      \"table_names_or_prefixes\": [\r
		        \"%\"\r
		      ],\r
		      \"readers\": [\r
		        \"user\",\r
		        \"commerce\"\r
		      ],\r
		      \"writers\": [\r
		        \"user\",\r
		        \"commerce\"\r
		      ],\r
		      \"admins\": [\r
		        \"user\",\r
		        \"commerce\"\r
		      ]\r
		    }\r
		  ]\r
		}"
}

[chreniuc]

Here's an example for those that are still struggling to make it work, because on the non-existent docs for this, just so you won't waste time as I did:

# Missing part
  cells:
  - name: decontabodusseldorf
    gateway:
      authentication:
        static:
          secret:
            name: vt-config-secret
            key: users.json
      replicas: 1
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          memory: 256Mi
  vitessDashboard:
    cells:
    - decontabodusseldorf
    extraFlags:
      security_policy: read-only
    replicas: 1
    resources:
      limits:
        memory: 128Mi
      requests:
        cpu: 100m
        memory: 128Mi
  keyspaces:
  - name: ionescu
    turndownPolicy: Immediate
    partitionings:
    - equal:
        parts: 1
        shardTemplate:
          databaseInitScriptSecret:
            name: vt-config-secret
            key: init_db.sql
          replication:
            enforceSemiSync: false
            initializeBackup: true
          tabletPools:
          - cell: decontabodusseldorf
            type: replica
            replicas: 1
            extraVolumes:
            - name: acl-ionescu
              configMap:
                name: vt-config-configmap
            extraVolumeMounts:
            - name: acl-ionescu
              mountPath: /mnt
            vttablet:
              extraFlags:
                db_charset: utf8mb4
                enforce-tableacl-config: "true" 
                queryserver-config-strict-table-acl: "true"
                table-acl-config: /mnt/acl_users_rights.json # key from the config file
                table-acl-config-reload-interval: 5m
              resources:
                limits:
                  memory: 1Gi
                requests:
                  cpu: 200m
                  memory: 1Gi
            mysqld:
              resources:
                requests:
                  cpu: 300m
                  memory: 1Gi
            dataVolumeClaimTemplate:
              accessModes: ["ReadWriteOnce"]
              resources:
                requests:
                  storage: 1Gi
  updateStrategy:
    type: Immediate
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: vt-config-configmap
data:
  acl_users_rights.json: |
    {
      "table_groups": [
          {
              "name": "ionescu",
              "table_names_or_prefixes": ["%"],
              "readers": ["ionescu_backend","ionescu_admin", "ionescu_read"],
              "writers": [ "ionescu_backend","ionescu_admin", "ionescu_write"],
              "admins": ["ionescu_admin"]
          }
      ]
    }
---
apiVersion: v1
kind: Secret
metadata:
  name: vt-config-secret
type: Opaque
stringData:
  users.json: |
    {
      "ionescu_backend": [{
        "UserData": "ionescu_backend",
        "Password": "ionescu"
      },
      {
        "UserData": "ionescu_backend",
        "Password": "ionescu2"
      }],
      "ionescu_admin": [{
        "UserData": "ionescu_admin",
        "Password": "ionescu"
      }],
      "ionescu_read": [{
        "UserData": "ionescu_read",
        "Password": "ionescu"
      }],
      "ionescu_write": [{
        "UserData": "ionescu_write",
        "Password": "ionescu"
      }]
    }