[JIRA] (JENKINS-60897) Allow folders plugin to work with any credentials provider

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding created an issue

Jenkins / JENKINS-60897 Allow folders plugin to work with any credentials provider Issue Type: Improvement Assignee: Chris Kilding Components: cloudbees-folder-plugin Created: 2020-01-28 17:41 Priority: Minor Reporter: Chris Kilding Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider. I would like to extend the plugin so that it can provide its access control layer (ACL) over any credentials provider. The benefits of this include: Only write the access control logic once. Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made. It works the same way everywhere. Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL. ACL can be written in JCasC YAML. Each folder entry just needs to have a list of allowed credential IDs. Single Responsibility Principle. Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers. Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding updated an issue

Jenkins / JENKINS-60897 Allow folders plugin to work with any credentials provider

Change By: Chris Kilding

Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider.

I would like to extend the plugin so that it can provide its access control layer (ACL) over *any* credentials provider. h2. Benefits

The benefits of this include:

* *Only write the access control logic once.* Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made. * *It works the same way everywhere.* Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL. * *ACL can be written in JCasC YAML.* Each folder entry just needs to have a list of allowed credential IDs. * *Single Responsibility Principle.* Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers. h2. Questions * JCasC YAML schema for the ACL * Default credential access behaviour when folders plugin is present, but no credential restrictions are configured for that credential: ** Default allow? (Treat it as a global credential) ** Default deny? (Don't ask, don't get) * Making ACL work with other folder types (GitHub/Bitbucket Organization Folders)

Add Comment

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding updated an issue

Jenkins / JENKINS-60897 Allow folders plugin to work with any credentials provider Change By: Chris Kilding

Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider. I would like to extend the plugin so that it can provide its access control layer (ACL) over *any* credentials provider. h2. Benefits

* *Only write the access control logic once.* Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made. * *It works the same way everywhere.* Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL. * *ACL can be written in JCasC YAML.* Each folder entry just needs to have a list of allowed credential IDs. * *Single Responsibility Principle.* Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers.

h2. Questions Tasks * Design JCasC YAML schema for the ACL * Default credential access Design Web UI for the ACL * Decide on default behaviour when folders plugin is present, a job accesses a credential, but no credential restrictions are configured for that credential:

** Default allow? (Treat it as a global credential) ** Default deny? (Don't ask, don't get)

* Making Make ACL work with other folder types (GitHub/Bitbucket Organization Folders) * Deprecate/remove legacy bits of CredentialsProvider / CredentialsStore API that were meant to be used for access control (since it would not be their job any more) * Ensure ease of use with infrastructure tools like Terraform (it should be as simple as possible to have Terraform define Secrets Manager secrets, then interpolate the relevant IDs into the JCasC YAML).

Add Comment

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding updated an issue

Jenkins / JENKINS-60897

Allow folders plugin to work with any credentials provider

Change By: Chris Kilding Issue Type: Improvement Epic

Add Comment

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding updated an issue

Jenkins / JENKINS-60897 Allow folders plugin to work with any credentials provider Change By: Chris Kilding

Today the folders plugin provides an access control layer over its own local credentials provider. This works, but it means that if a user wants to restrict access to a particular credential by folder, they cannot store it in their preferred provider: instead they must copy it into the FolderCredentialsProvider. I would like to extend the plugin so that it can provide its access control layer (ACL) over *any* credentials provider. h2. Benefits * *Only write the access control logic once.* Today, other providers would have to copy-paste the intricate ACL logic from the folders plugin, and then keep that up to date with any changes. Mistakes will inevitably be made. * *It works the same way everywhere.* Folders-based ACL will not have provider-specific behaviour, or a provider-specific storage schema for the ACL. * *ACL can be written in JCasC YAML.* Each folder entry just needs to have a list of allowed credential IDs. * *Single Responsibility Principle.* Providers do one thing: store and retrieve credentials. Folders plugin does one thing (for credentials): run the ACL over the providers.

h2. Tasks TODO convert these to sub-tasks

* Design JCasC YAML schema for the ACL

* Design Web UI for the ACL * Decide on default behaviour when folders plugin is present, a job accesses a credential, but no restrictions are configured for that credential:

** Default allow? (Treat it as a global credential) ** Default deny? (Don't ask, don't get)

* Make ACL work with other folder types (GitHub/Bitbucket Organization Folders)

* Deprecate/remove legacy bits of CredentialsProvider / CredentialsStore API that were meant to be used for access control (since it would not be their job any more) * Ensure ease of use with infrastructure tools like Terraform (it should be as simple as possible to have Terraform define Secrets Manager secrets, then interpolate the relevant IDs into the JCasC YAML).

Add Comment

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding updated an issue

Jenkins / JENKINS-60897 Allow folders plugin to work with any credentials provider

Change By: Chris Kilding Component/s: aws-secrets-manager-credentials-provider-plugin Component/s: credentials-plugin Component/s: kubernetes-credentials-provider-plugin

Add Comment

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding updated an issue

Jenkins / JENKINS-60897 Allow folders plugin to work with any credentials provider

Change By: Chris Kilding Labels: JEP-225 Epic Name: JEP-225: Folders-based access control layer for any credentials provider

Add Comment

[chris+jenkins@chriskilding.com (JIRA)]

Chris Kilding commented on JENKINS-60897

Re: Allow folders plugin to work with any credentials provider JENKINS-58951 is to implement JCasC support for the folders plugin. This might need to be implemented before we can add the ACL on top.

Add Comment