chore: rbac v1 cleanup (#2385)

Removed rbac v1 and its leftovers, kept shared parts RHINENG-26714

Author: pindo696

common/config.py

@@ -120,12 +120,6 @@ def __init__(self):
 
         self.dashboard_rules_age = int(os.getenv("DASHBOARD_RULES_AGE", "30"))
 
-        # RBAC request timeout in seconds
-        self.rbac_timeout = int(os.getenv("RBAC_TIMEOUT", "15"))
-        self.disable_rbac = strtobool(os.getenv("DISABLE_RBAC", "FALSE"))
-        # Granular RBAC feature-flag
-        self.granular_rbac = strtobool(os.getenv("GRANULAR_RBAC", "FALSE"))
-
         # Minimal systems in account to enable cache
         self.cache_minimal_account_systems = int(os.getenv("CACHE_MINIMAL_ACCOUNT_SYSTEMS", "400"))
         self.keep_cache_hours = int(os.getenv("CACHE_KEEP_KEEPALIVE_HOURS", "168"))

common/feature_flags.py

@@ -20,7 +20,6 @@
 # Flag toggles
 CACHES_FEATURE = "vulnerability.account_cache"
 OS_EXPOSURE_REPORT_FEATURE = "vulnerability.os_exposure_report"
-OMIT_PERMISSION_METADATA_FROM_RESPONSE_FEATURE = "vulnerability.omit_permission_metadata_from_response"
 KESSEL_ENABLED = "vulnerability.kessel_enabled"
 NEW_NOTIFICATIONS_FEATURE = "vulnerability.new_notifications"
 

conf/manager.env

@@ -1,5 +1,3 @@
-DISABLE_RBAC=FALSE
-GRANULAR_RBAC=FALSE
 MAX_REQUEST_SIZE_MB=2
 MAXIMUM_PAGE_SIZE=0
 API_MAX_RPS=100

conf/manager_base.env

@@ -3,7 +3,6 @@ PATH_PREFIX=/api
 GUNICORN_WORKERS=4
 READ_ONLY_MODE=FALSE
 RBAC_URL=http://platform_mock:8000
-RBAC_TIMEOUT=15
 API_VERSION=v1
 TASKOMATIC_HOST=http://ve_taskomatic:8000
 NOTIFICATOR_HOST=http://ve_notificator:8000

deploy/clowdapp.yaml

@@ -81,14 +81,8 @@ objects:
           value: '10'
         - name: DASHBOARD_RULES_AGE
           value: '30'
-        - name: RBAC_TIMEOUT
-          value: '15'
-        - name: DISABLE_RBAC
-          value: ${DISABLE_RBAC}
         - name: DEFAULT_PAGE_SIZE
           value: '5000'
-        - name: GRANULAR_RBAC
-          value: ${GRANULAR_RBAC}
         - name: UNLEASH_BOOTSTRAP_FILE
           value: ${UNLEASH_BOOTSTRAP_FILE}
         - name: MAXIMUM_PAGE_SIZE
@@ -956,9 +950,6 @@ parameters:
 - name: SYSTEM_DELETION_THRESHOLD
   description: Delete systems marked as deleted before N hours
   value: "1"
-- name: DISABLE_RBAC
-  description: Toggle to disable RBAC in manager
-  value: "FALSE"
 - name: CACHE_MINIMAL_ACCOUNT_SYSTEMS
   value: '400'
 - name: CACHE_KEEP_KEEPALIVE_HOURS
@@ -969,8 +960,6 @@ parameters:
   value: '30'
 - name: DB_MIN_POOL_SIZE
   value: '10'
-- name: GRANULAR_RBAC
-  value: "TRUE"
 - name: MAX_LOADED_EVALUATOR_MSGS
   value: "20"
 - name: MAX_LOADED_LISTENER_MSGS

develfeatureflags.json

@@ -57,20 +57,6 @@
       "strategy": "default",
       "parameters": {}
     },
-    {
-      "name": "vulnerability.omit_permission_metadata_from_response",
-      "type": "release",
-      "enabled": false,
-      "stale": false,
-      "strategies": [
-        {
-          "name": "default",
-          "parameters": {}
-        }
-      ],
-      "strategy": "default",
-      "parameters": {}
-    },
     {
       "name": "vulnerability.kessel_enabled",
       "type": "release",

manager/base.py

@@ -56,8 +56,7 @@
 from common.utils import validate_cve_cache_keepalive
 
 from .filters import apply_filters
-from .rbac_manager import RbacException
-from .rbac_manager import RbacManager
+from .rbac_exceptions import RbacException
 
 LOGGER = get_logger(__name__)
 CFG = Config()
@@ -163,18 +162,14 @@ def auth_common(identity, x_rh_identity):  # pylint: disable=unused-argument
             LOGGER.warning("Invalid system UUID: %s", system_cn)
             return None
 
-    if identity_type != "System":  # Call RBAC by default for non-system identity types (User, ServiceAccount)
-        rbac_manager = RbacManager()
-        rbac_perms, group_ids = rbac_manager.fetch_permissions(x_rh_identity)
-    else:
-        rbac_perms, group_ids = [], []
+    group_ids = []
 
     principal_id = extract_principal_id(identity)
     if principal_id is None:
         raise RbacException({"msg": f"Unknown principal type: {identity['identity']['type']}"})
 
     return {"uid": {"account_number": account_number, "org_id": org_id, "identity_type": identity_type, "system_cn": system_cn,
-                    "rbac_perms": rbac_perms, "group_ids": group_ids, "principal_id": principal_id}}
+                    "group_ids": group_ids, "principal_id": principal_id}}
 
 
 def auth(x_rh_identity, required_scopes=None):  # pylint: disable=unused-argument

manager/cve_handler.py

@@ -67,9 +67,8 @@
 from .filters import apply_filters
 from .filters import filter_types
 from .list_view import ListView
-from .rbac_manager import RbacFilterRoutePermissions
-from .rbac_manager import RbacManager as RBAC
-from .rbac_manager import RbacRoutePermissions
+from .rbac_v2_manager import RbacFilterRoutePermissions
+from .rbac_v2_manager import RbacRoutePermissions
 from .rbac_v2_manager import RbacV2Manager as RBACv2
 
 LOGGER = get_logger(__name__)
@@ -660,8 +659,6 @@ def _cve_details(cls, synopsis, advisory_available):
         return retval
 
     @classmethod
-    @RBAC.need_permissions(RbacRoutePermissions.VULNERABILITY_RESULTS)
-    @RBAC.need_permissions_filter_value(RbacFilterRoutePermissions.CSV_FORMAT_ENDPOINTS)
     @RBACv2.enforce_workspace_permission(RbacRoutePermissions.VULNERABILITY_RESULTS)
     @RBACv2.enforce_workspace_permission_filter_value(RbacFilterRoutePermissions.CSV_FORMAT_ENDPOINTS)
     def handle_get(cls, **kwargs):
@@ -695,8 +692,6 @@ def _cve_exists(synopsis):
             raise ApplicationException("No such CVE ID", 404) from exc
 
     @classmethod
-    @RBAC.need_permissions(RbacRoutePermissions.VULNERABILITY_RESULTS)
-    @RBAC.need_permissions_filter_value(RbacFilterRoutePermissions.REPORTABLE_ENDPOINTS)
     @RBACv2.enforce_workspace_permission(RbacRoutePermissions.VULNERABILITY_RESULTS)
     @RBACv2.enforce_workspace_permission_filter_value(RbacFilterRoutePermissions.REPORTABLE_ENDPOINTS)
     def handle_get(cls, **kwargs):  # pylint: disable=too-many-branches
@@ -847,7 +842,6 @@ class PatchCveRisk(PatchRequest):
     _conflict_target = [CveAccountData.cve_id, CveAccountData.rh_account_id]
 
     @classmethod
-    @RBAC.need_permissions(RbacRoutePermissions.CVE_BR_AND_STATUS_EDIT)
     @RBACv2.enforce_default_workspace_permission(RbacRoutePermissions.CVE_BR_AND_STATUS_EDIT)
     def handle_patch(cls, **kwargs):
         """Set business risk for a CVE"""
@@ -903,7 +897,6 @@ class PatchCveStatus(PatchRequest):
     _conflict_target = [CveAccountData.cve_id, CveAccountData.rh_account_id]
 
     @classmethod
-    @RBAC.need_permissions(RbacRoutePermissions.CVE_BR_AND_STATUS_EDIT)
     @RBACv2.enforce_default_workspace_permission(RbacRoutePermissions.CVE_BR_AND_STATUS_EDIT)
     def handle_patch(cls, **kwargs):
         """Set status for a CVE"""

manager/dashbar_handler.py

@@ -33,8 +33,7 @@
 from .base import parse_tags
 from .filters import apply_filters
 from .filters import filter_types
-from .rbac_manager import RbacManager as RBAC
-from .rbac_manager import RbacRoutePermissions
+from .rbac_v2_manager import RbacRoutePermissions
 from .rbac_v2_manager import RbacV2Manager as RBACv2
 
 LOGGER = get_logger(__name__)
@@ -47,7 +46,6 @@ class GetDashbar(GetRequest):
     _endpoint_name = r"/v1/dashbar"
 
     @classmethod
-    @RBAC.need_permissions(RbacRoutePermissions.VULNERABILITY_RESULTS)
     @RBACv2.enforce_workspace_permission(RbacRoutePermissions.VULNERABILITY_RESULTS)
     def handle_get(cls, **kwargs):
         # pylint: disable=singleton-comparison

manager/dashboard_handler.py

@@ -39,8 +39,7 @@
 from .base import round_to_100_percent
 from .filters import apply_filters
 from .filters import filter_types
-from .rbac_manager import RbacManager as RBAC
-from .rbac_manager import RbacRoutePermissions
+from .rbac_v2_manager import RbacRoutePermissions
 from .rbac_v2_manager import RbacV2Manager as RBACv2
 
 LOGGER = get_logger(__name__)
@@ -58,7 +57,6 @@ class GetDashboard(GetRequest):
     _endpoint_name = r"/v1/dashboard"
 
     @classmethod
-    @RBAC.need_permissions(RbacRoutePermissions.VULNERABILITY_RESULTS)
     @RBACv2.enforce_workspace_permission(RbacRoutePermissions.VULNERABILITY_RESULTS)
     def handle_get(cls, **kwargs):
         # pylint: disable=singleton-comparison, too-many-branches, too-many-statements