We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
在过去的版本中,为了让用户能够更方便、快捷地使用CMDB产品,尽可能地减少了操作的复杂性,提高企业团队间的信息沟通效率,我们对资源并未设计查看权限功能,这可以让用户在使用过程中更加轻松,不需要经过繁琐的权限申请与审批流程。但随着企业信息安全需求的不断提升,我们的CMDB产品也需要不断改进和升级,以满足客户在资源管理和信息安全方面的需求。为了更好地保护企业信息,我们决定在新版本的CMDB产品中增强对资源、模型的权限控制功能。
在模型级别权限新版本(后称空间级权限)的CMDB中,我们对资源、模型增加了若干权限,用户需要申请对应的资源列表查看权限才能查看具体的资源实例、模型详情。这将有助于确保敏感数据只能被授权的用户访问,从而降低企业信息泄露的风险。为了帮助大家顺利地完成版本升级,我们将在这份版本升级指引,详细介绍了升级过程中需要注意的事项和操作步骤。我们希望通过这次升级,能够满足大家对于权限方面的需求,保证数据安全。
空间级权限
第四章节
第五章节
风险
替换为之前不带「空间级权限」的二进制
调用cmdb注册权限的接口进行重新注册权限点,如下操作:
curl -X POST -H 'Content-Type:application/json' -H 'BK_USER:migrate' -H 'HTTP_BLUEKING_SUPPLIER_ID:0' --data '{"host": "http://"authserver ip":"authserver port"}' http://"adminserver ip":"adminserver port"/migrate/v3/authcenter/init
替换为之前不带「空间级权限」的helm chart,正常情况会默认跑job进行重新注册权限点的操作
如果用户申请了本次空间级权限新加的查看权限,那么回滚完之后,这些权限会消失,后续再更新到空间级权限版本,用户需要重新申请权限
{ "annotations": { "list": [ { "builtIn": 1, "datasource": "-- Grafana --", "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "target": { "limit": 100, "matchAny": false, "tags": [], "type": "dashboard" }, "type": "dashboard" } ] }, "editable": true, "gnetId": null, "graphTooltip": 0, "id": 5, "links": [], "panels": [ { "datasource": null, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "line", "fillOpacity": 0, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 10, "scaleDistribution": { "type": "linear" }, "showPoints": "always", "spanNulls": true, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 18, "w": 24, "x": 0, "y": 0 }, "id": 2, "interval": null, "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom" }, "tooltip": { "mode": "multi" } }, "targets": [ { "data": { "alias": "list_biz_hosts(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_biz_hosts", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_biz_hosts" }, { "data": { "alias": "find_module_host_relation(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_msecs_cost", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: find_module_host_relation", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "find_module_host_relation" }, { "data": { "alias": "find_host_by_service_template(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: find_host_by_service_template", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "find_host_by_service_template" }, { "data": { "alias": "find_host_by_set_template(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: find_host_by_set_template", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "find_host_by_set_template" }, { "data": { "alias": "list_resource_pool_hosts(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_resource_pool_hosts", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_resource_pool_hosts" }, { "data": { "alias": "list_biz_hosts_topo(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_biz_hosts_topo", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_biz_hosts_topo" }, { "data": { "alias": "list_host_total_mainline_topo(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_host_total_mainline_topo", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_host_total_mainline_topo" } ], "title": "cmdb空间级权限上线切换涉及接口调用记录", "type": "timeseries" } ], "refresh": "", "schemaVersion": 30, "style": "dark", "tags": [], "templating": { "list": [] }, "time": { "from": "now-30d", "to": "now" }, "timepicker": {}, "timezone": "", "title": "cmdb空间级权限上线切换涉及接口调用记录", "uid": "DiH-O5GIz", "version": 1 }
基于v7.1版本输出方案
# 启用 bkESB 日志采集 yq eval '.bkEsb.bkLogConfig.enabled = true' -i environments/default/bkapigateway-custom-values.yaml.gotmpl # 设置上报的 DataId yq eval '.bkEsb.bkLogConfig.containerDataId = 1573023' -i environments/default/bkapigateway-custom-values.yaml.gotmpl yq eval '.bkEsb.bkLogConfig.stdoutDataId = 1573022' -i environments/default/bkapigateway-custom-values.yaml.gotmpl
helmfile -f base-blueking.yaml.gotmpl -l name=bk-apigateway apply
{{ "annotations": { "list": [ { "builtIn": 1, "datasource": "-- Grafana --", "enable": true, "hide": true, "iconColor": "rgba(0, 211, 255, 1)", "name": "Annotations & Alerts", "target": { "limit": 100, "matchAny": false, "tags": [], "type": "dashboard" }, "type": "dashboard" } ] }, "editable": true, "gnetId": null, "graphTooltip": 0, "id": 4, "links": [], "panels": [ { "datasource": null, "fieldConfig": { "defaults": { "color": { "mode": "palette-classic" }, "custom": { "axisLabel": "", "axisPlacement": "auto", "barAlignment": 0, "drawStyle": "line", "fillOpacity": 0, "gradientMode": "none", "hideFrom": { "legend": false, "tooltip": false, "viz": false }, "lineInterpolation": "smooth", "lineWidth": 1, "pointSize": 10, "scaleDistribution": { "type": "linear" }, "showPoints": "always", "spanNulls": true, "stacking": { "group": "A", "mode": "none" }, "thresholdsStyle": { "mode": "off" } }, "mappings": [], "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "red", "value": 80 } ] } }, "overrides": [] }, "gridPos": { "h": 18, "w": 24, "x": 0, "y": 0 }, "id": 2, "interval": null, "options": { "legend": { "calcs": [], "displayMode": "list", "placement": "bottom" }, "tooltip": { "mode": "multi" } }, "targets": [ { "data": { "alias": "list_biz_hosts(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_biz_hosts", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_biz_hosts" }, { "data": { "alias": "find_module_host_relation(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_msecs_cost", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: find_module_host_relation", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "find_module_host_relation" }, { "data": { "alias": "find_host_by_service_template(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: find_host_by_service_template", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "find_host_by_service_template" }, { "data": { "alias": "find_host_by_set_template(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: find_host_by_set_template", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "find_host_by_set_template" }, { "data": { "alias": "list_resource_pool_hosts(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_resource_pool_hosts", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_resource_pool_hosts" }, { "data": { "alias": "list_biz_hosts_topo(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_biz_hosts_topo", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_biz_hosts_topo" }, { "data": { "alias": "list_host_total_mainline_topo(调用者:$tag_req_app_code)", "conditions": [], "dimensions": [ "req_app_code" ], "index": { "id": [ "host_process", 33 ], "labels": [ "进程", "[采集项]bkapigateway_esb_container_container" ] }, "method": "value_count", "metric": "req_status", "period": 86400, "periodUnitSet": { "periodUnit": "min", "timeNum": 1440 }, "queryString": "req_component_name: list_host_total_mainline_topo", "size": 50, "target": { "expandKeys": [], "realValues": [], "treeData": [], "values": [] } }, "datasourceId": "bk_log_datasource", "hide": false, "name": "BlueKing Log TimeSeries", "refId": "list_host_total_mainline_topo" } ], "title": "cmdb空间级权限上线切换涉及接口调用记录", "type": "timeseries" } ], "refresh": "", "schemaVersion": 30, "style": "dark", "tags": [], "templating": { "list": [] }, "time": { "from": "now-30d", "to": "now" }, "timepicker": {}, "timezone": "", "title": "cmdb空间级权限上线切换涉及接口调用记录", "uid": "DiH-O5GIz", "version": 6 }
egrep -oh 'req_component_name": "[a-z0-9_-]+|req_app_code": "[a-z0-9_-]+' /data/bkce/logs/open_paas/esb_api.log* | awk -F'"' 'NR%2==0{print prev" "$NF} {prev=$NF}' | sort | uniq -c
在权限升级之后,所有用户默认不拥有新添加的权限。这可能导致许多用户需要大量申请权限,为了减轻用户在申请权限方面的困扰,您可以参考本方案的步骤进行处理。
注意:其中“模型查看”需要关联资源实例,这里资源实例需要选择希望可查看的模型。
注意:企业需根据自己的实际需求选择需要添加哪些组织或人员
tool.zip
The text was updated successfully, but these errors were encountered:
No branches or pull requests
cmdb - 模型级别权限(空间级权限)
一、 概述
在过去的版本中,为了让用户能够更方便、快捷地使用CMDB产品,尽可能地减少了操作的复杂性,提高企业团队间的信息沟通效率,我们对资源并未设计查看权限功能,这可以让用户在使用过程中更加轻松,不需要经过繁琐的权限申请与审批流程。但随着企业信息安全需求的不断提升,我们的CMDB产品也需要不断改进和升级,以满足客户在资源管理和信息安全方面的需求。为了更好地保护企业信息,我们决定在新版本的CMDB产品中增强对资源、模型的权限控制功能。
在模型级别权限新版本(后称
空间级权限
)的CMDB中,我们对资源、模型增加了若干权限,用户需要申请对应的资源列表查看权限才能查看具体的资源实例、模型详情。这将有助于确保敏感数据只能被授权的用户访问,从而降低企业信息泄露的风险。为了帮助大家顺利地完成版本升级,我们将在这份版本升级指引,详细介绍了升级过程中需要注意的事项和操作步骤。我们希望通过这次升级,能够满足大家对于权限方面的需求,保证数据安全。二、风险
空间级权限版本(v3.13.1)增加了若干个操作权限,分别是:
这些操作权限的详细可在
第四章节
查看。空间级权限版本前以上对应的操作均是无需鉴权的,升级后用户需要拥有对应的操作权限才能正常使用对应的功能。所以您需要评估你的企业中哪些人员应该需要具备哪些权限更为合理。空间级权限版本(v3.13.1)对部分API增加了“业务访问”鉴权逻辑,这些API分别是:
这些增加“业务访问”鉴权逻辑的API的详细可在
第五章节
查看。涉及到的接口之前不需要权限即可获取到数据。本次版本升级后,接口需要有“业务访问”才可进行调用。所以您需要梳理哪些第三方平台或者用户调用的这些接口,及时给他们赋予权限,若梳理有误或者缺少这个步骤,在更新这个版本后,第三方平台可能会由于没有权限调用失败,进而引发线上故障!这里特别强调一下,用户在使用这些接口时可能存在两种场景:
三、升级相关的权限处理方案
风险
影响方,由影响方评估其是否需要“使用虚拟账户来调用”。扫描esb日志工具请参考第七章节;3.1 根据风险二的影响方,让调用者评估出行为是“平台调用”还是“个人调用”
3.2 “平台调用”请采用“创建虚拟账户”方式解决,“创建虚拟账户”方式如下:
- 在用户管理中,创建“虚拟账户”;
- 在权限中心中,为“虚拟账户”授予“配置平台-业务访问-{负责的业务}”;
- 为app_code和接口开启“免用户认证应用白名单”(参考:https://bk.tencent.com/s-mart/community/question/11338?type=answer);
- 在调用API时,payload中bk_username填写为“虚拟账户”;
3.3 “用户调用”场景,需用户自行在权限中申请“配置平台-业务访问-{负责的业务}”权限
四、新增的权限
五、涉及修改的API
六、回滚方案
二进制环境
替换为之前不带「空间级权限」的二进制
调用cmdb注册权限的接口进行重新注册权限点,如下操作:
容器化环境
替换为之前不带「空间级权限」的helm chart,正常情况会默认跑job进行重新注册权限点的操作
注意点
如果用户申请了本次空间级权限新加的查看权限,那么回滚完之后,这些权限会消失,后续再更新到空间级权限版本,用户需要重新申请权限
七、配置日志采集器收集 ESB 调用记录
二进制环境
容器化环境
注意事项
八、升级后的“模型、资源增加查看权限”的处理参考方案
tool.zip
The text was updated successfully, but these errors were encountered: