Skip to content

Support RBAC controls on subresources #456

Open
Open
Support RBAC controls on subresources#456
Assignees
scotwells

Description

@scotwells
scotwells
opened on Dec 15, 2025

Summary

Custom resources support subresources like Status that need separate RBAC permissions from the owning resource. Internal components are typically setup to update the status sub resource with the observed status of the resource. This means we need to control / prevent users from updating the status sub resource.

In the future, e.g. for Datum Connect, we will need to allow users to update the status subresource on some resources (e.g. Connector) so that clients they use can update the status of resources powered by the client.

Details

Thinking we'll add a new subresources field to the ProtectedResource custom resource that allows the user to configure the subresources available on the resource.

Example of a status subresource being configured on a resource:

apiVersion: iam.miloapis.com/v1alpha1
kind: ProtectedResource
...
spec:
  ...
  subresources:
    - status

The permissions in the system should follow the following format:

<service>/<resource>[/<subresource>].<permission>

This means a new status subresource being configured on a ProtectedResource should result in the following two permissions being made available:

networking.datumapis.com/httpproxies/status.get
networking.datumapis.com/httpproxies/status.update

OpenFGA integration

We need to make sure that the openfga authz webhook is updated to build the correct permission string when a status subresource is specified in the SubjectAccessReview request.

Activity

  1. scotwells
    assigned
    JoseSzycho
    on Dec 15, 2025
  2. scotwells
    added this to Eng - Datum 1.0on Dec 15, 2025
  3. github-project-automation
    moved this to Backlog in Eng - Datum 1.0on Dec 15, 2025
  4. scotwells
    assigned
    scotwells
    and unassigned
    JoseSzycho
    on Oct 2, 2026

  5. scotwells commented on Oct 2, 2026

    @scotwells
    scotwells
    on Oct 2, 2026
    ContributorAuthor

    Implementation plan:

    • Add subresource declarations to Milo ProtectedResource and use service/resource[/subresource].verb consistently for Role validation, OpenFGA model/tuple programming, and authorization checks. Keep patch and update distinct.
    • Put the capability behind an explicit feature flag, off by default. Disabled preserves existing authorization behavior; enabled requires an explicitly registered and granted subresource permission, with no fallback to base-resource permissions.
    • Extend the OpenFGA provider’s existing datum-cloud/test-infra kind setup into a reusable environment running locally built Milo and provider images with webhook authorization enabled. Keep downstream service adoption out of scope.
    • Validate real non-admin API requests end to end: base access, denied status PATCH without a grant, allowed PATCH with an explicit grant, permission isolation, and revocation. Cover both feature-disabled compatibility and feature-enabled enforcement, plus model/Role/PolicyBinding reconciliation.

    Implementation is starting across the Milo API, provider, and local E2E harness in parallel. Completion requires a successful local kind run; direct SubjectAccessReview tests alone are insufficient.

  6. scotwells commented on Oct 2, 2026

    @scotwells
    scotwells
    on Oct 2, 2026
    ContributorAuthor

    Progress update:

    • Core subresource authorization is implemented in Milo #824 and openfga-provider #139, including permission validation and control-plane programming. The feature is off by default; when enabled, subresources require explicit permissions with no fallback to the parent resource.
    • Audited 21 repositories and opened 16 permission-adoption PRs. Customers receive status-subresource access only for Connectors; normal resource reads still include status.
    • Independent implementation reviews completed. Local kind validation passed 25 real API assertions, covering compatibility, enforcement, permission isolation, and revocation. The reusable provider environment uses datum-cloud/test-infra and has been shut down.
    • The unrelated Search E2E response-capture failure is fixed separately in Search #119. Its remote kind run passed all 16 E2E tests and 11 helper tests.

    Next: review and merge the API/schema changes before dependent PRs, deploy the provider and permission updates, then explicitly enable enforcement.

    Status-permission PRs:

  7. scotwells
    added a commit that references this issue on Oct 2, 2026

    feat(iam): declare permissions for protected subresources (#824)

    3da1adc
  8. 0xmc
    added a commit that references this issue on Oct 4, 2026

    fix: Let metrics queries pass Milo's permission check (#195)

    82a55b9
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions