cgrinds
commented
1 month ago Hi @mamoep
"legacy" roles is a misnomer; perhaps a better name would be RBAC roles. Either way, the legacy roles are not going away, and both REST and ZAPI roles are defined in terms of those RBAC-based roles. In other words, when you modify a rest-role, ONTAP translates that REST role into an RBAC role and updates the RBAC access to satisfy the REST role. RBAC roles are the foundational mechanism to control access, and other higher-level ways of controlling access ultimately are implemented in terms of RBAC.
Harvest also uses ONTAP's REST private CLI passthrough. As of commit 5ae91b7d, there are 23 templates in the conf/rest directory that use an /api/private/ endpoint. Since the private CLI passthrough invokes the ONTAP CLI, those endpoints are controlled by RBAC permissions instead of REST permissions.
Here's an example:
Starting with a role that does not exist
security login rest-role show -role tmp-rest
There are no entries matching your query.
security login role show -role tmp-rest
There are no entries matching your queryCreate a rest role granting access to /api/svm/svms
security login rest-role create -role tmp-rest -access readonly -api /api/svm/svmsVerify that the role was created with readonly access
security login rest-role show -role tmp-rest
Role Access
Vserver Name API Level
---------- ------------- ------------------- ------
umeng-aff300-01-02
tmp-rest /api/svm/svms readonlyCreating the rest-role also caused an RBAC role to be created
Also notice that the RBAC command DEFAULT was modified too, with all access being removed.
security login role show -role tmp-rest
Role Command/ Access
Vserver Name Directory Query Level
---------- ------------- --------- ----------------------------------- --------
umeng-aff300-01-02
tmp-rest DEFAULT none
template provision readonly
vserver readonly
3 entries were displayed.Since creating REST roles also sets the underlying RBAC permissions, we attempted several releases ago to unify the least privilege approach documentation by listing only the REST role permissions. If we had succeeded in doing that, it would have meant that setting the REST-roles would have enabled both a ZAPI and REST least privileged approach. Unfortunately, there were a few gaps that made us abandon that approach. For example, there was no REST role that would cause system health subsystem show to be added as an RBAC command. For instance, security login role show-rest -commands "system health subsystem show" returns nothing. While the REST collectors do not need that privilege, the ZAPI collectors do.
All of which is to say, we hear you and will add that documentation. 😄
Digging through my notes from the last time I looked at this, I had this list which may be incomplete:
security login rest-role create -role harvest-rest-role -access readonly -api /api/cluster
security login rest-role create -role harvest-rest-role -access readonly -api /api/cluster/counter/tables
security login rest-role create -role harvest-rest-role -access readonly -api /api/cluster/nodes
security login rest-role create -role harvest-rest-role -access readonly -api /api/network/ip/interfaces
security login rest-role create -role harvest-rest-role -access readonly -api /api/snapmirror/relationships
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/aggregates
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/disks
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/luns
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/qos/policies
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/qos/workloads
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/qos/workloads
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/shelves
security login rest-role create -role harvest-rest-role -access readonly -api /api/storage/volumes
security login rest-role create -role harvest-rest-role -access readonly -api /api/svm/svms
security login rest-role create -role harvest-rest-role -access readonly -api /api/security/ssh
mamoep
Is your feature request related to a problem? Please describe. The documentation has a detailed list of permissions needed for legacy roles. For rest-role it is just a readonly for the whole api.
Describe the solution you'd like Please document a least-privilege approach for
security login rest-role createcommand.