From e8bc614155a0af1b8d0f4b406a3b829d622d8e20 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Wed, 3 Nov 2021 12:02:24 +0100 Subject: [PATCH] Make RBAC rule migration more robust --- pkg/provision/migrations_202109_rbac.go | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/pkg/provision/migrations_202109_rbac.go b/pkg/provision/migrations_202109_rbac.go index 11787c86f..ab3aba084 100644 --- a/pkg/provision/migrations_202109_rbac.go +++ b/pkg/provision/migrations_202109_rbac.go @@ -2,6 +2,7 @@ package provision import ( "context" + "fmt" "strconv" "strings" @@ -40,6 +41,11 @@ func migratePre202109RbacRules(ctx context.Context, log *zap.Logger, s store.Sto return err } + var uniq = make(map[string]bool) + var uniqID = func(r *rbac.Rule) string { + return fmt.Sprintf("%s|%s|%d", r.Resource, r.Operation, r.RoleID) + } + for _, r := range rr { var ( cr = *r @@ -49,15 +55,26 @@ func migratePre202109RbacRules(ctx context.Context, log *zap.Logger, s store.Sto if action != 0 { err = store.DeleteRbacRule(ctx, s, &cr) if err != nil { - return err + return fmt.Errorf("could not delete RBAC rule %s: %v", r, err) + } + + if action == -1 { + log.Debug("removed obsolete RBAC rule", zap.Stringer("rule", r)) } } if action == 1 { + if uniq[uniqID(r)] { + log.Warn("skipping duplicate RBAC rule", zap.Stringer("rule", r)) + continue + } + err = store.CreateRbacRule(ctx, s, r) if err != nil { - return err + return fmt.Errorf("could not create RBAC rule %s: %v", r, err) } + + uniq[uniqID(r)] = true } }