Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

feat: add WorkspaceUpdates tailnet RPC#14847

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
ethanndickson merged 7 commits intomainfrom09-27-feat_add_workspaceupdates_rpc
Nov 1, 2024

Conversation

ethanndickson
Copy link
Member

@ethanndicksonethanndickson commentedSep 27, 2024•
edited
Loading

Closes#14716
Closes#14717

Adds a new user-scoped tailnet API endpoint (api/v2/tailnet) with a new RPC stream for receiving updates on workspaces owned by a specific user, as defined in#14716.

When a stream is started, theWorkspaceUpdatesProvider will begin listening on the user-scoped pubsub events implemented in#14964. When a relevant event type is seen (such as a workspace state transition), the provider will query the DB for all the workspaces (and agents) owned by the user. This gets compared against the result of the previous query to produce a set of workspace updates.

Workspace updates can be requested for any user ID, however only workspaces the authorised user is permitted toActionRead will have their updates streamed.
Opening a tunnel to an agent requires that the user can performActionSSH against the workspace containing it.

@ethanndicksonGraphite App
Copy link
MemberAuthor

ethanndickson commentedSep 27, 2024•
edited
Loading

@ethanndicksonethanndickson changed the titlefeat: add WorkspaceUpdates rpcfeat: add WorkspaceUpdates tailnet RPCSep 27, 2024
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch from22985f7 todb04bcfCompareSeptember 27, 2024 08:42
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch fromddc493e tod2d165eCompareSeptember 27, 2024 08:42
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch fromdb04bcf to50f874cCompareSeptember 30, 2024 09:35
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch 2 times, most recently fromd57f3e6 to8102c71CompareSeptember 30, 2024 12:12
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch from50f874c tofe1e8b5CompareOctober 1, 2024 04:14
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from8102c71 to4f57562CompareOctober 1, 2024 04:14
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch fromfe1e8b5 toaaf8e86CompareOctober 1, 2024 12:02
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch 2 times, most recently fromab7f678 tofb84465CompareOctober 1, 2024 12:16
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch frombe7fa9e tocb5adf4CompareOctober 1, 2024 12:22
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch fromfb84465 to1a8392dCompareOctober 1, 2024 12:36
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch fromcb5adf4 to2bc6e69CompareOctober 2, 2024 05:09
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from1a8392d to51cd615CompareOctober 2, 2024 05:09
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch from2bc6e69 to54cbfafCompareOctober 3, 2024 15:07
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from51cd615 tode1435dCompareOctober 3, 2024 15:07
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch from54cbfaf toaad36cfCompareOctober 4, 2024 03:45
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch fromde1435d to398fa2dCompareOctober 4, 2024 03:45
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch fromaad36cf tob5f7529CompareOctober 4, 2024 05:51
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from398fa2d to077608bCompareOctober 4, 2024 05:51
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch fromb5f7529 tofabe2d1CompareOctober 4, 2024 11:45
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from077608b toc762ae8CompareOctober 4, 2024 11:45
@github-actionsgithub-actionsbot added the staleThis issue is like stale bread. labelOct 12, 2024
@matifalimatifali removed the staleThis issue is like stale bread. labelOct 12, 2024
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch fromfabe2d1 tod89d373CompareOctober 17, 2024 06:55
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from84730b8 tof3b74b7CompareOctober 29, 2024 06:34
auth rbac.Authorizer

ctx context.Context
cancelFn func()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

ctx isn't used anywhere, so it andcancelFn are superfluous, which I think makesClose() on this superfluous.

Copy link
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

The intention was forsub to store a context who's parent isupdatesProvider's context, so that callingClose on the updates provider closes all the existing subscriptions - will fix.

@@ -133,7 +133,7 @@ var errDisconnect = xerrors.New("graceful disconnect")

func (c *connIO) handleRequest(req *proto.CoordinateRequest) error {
c.logger.Debug(c.peerCtx, "got request")
err := c.auth.Authorize(req)
err := c.auth.Authorize(c.coordCtx,req)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This needs to be thec.peerCtx ---coordCtx is the context of the Coordinator's lifetime.

You should add a test that adds a subject to a context you use to callCoordinate() and verify the subject is there on theAuthorize call. Same test for the AGPL implementation.

ethanndickson reacted with thumbs up emoji
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch frome05b286 toa45a43cCompareOctober 29, 2024 09:53
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch fromf3b74b7 tod1fac01CompareOctober 29, 2024 09:53
_ = testutil.RequireRecvCtx(ctx, t, ch)
// If we don't cancel the context, the coordinator close will wait until the
// peer request loop finishes, which will be after the timeout
peerCtxCancel()
Copy link
MemberAuthor

@ethanndicksonethanndicksonOct 29, 2024•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

This was actually passing without, but it would take the entire 10 seconds. Interestingly, the PGCoord doesn't have this behaviour

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Yeah, PGCoord is more aggressive with closing things down, forcibly booting anything still connected because it has contexts plumbed thru for background tasks like heartbeats. The AGPL coordinator is considerably simpler and has no coordinator-scoped context.

@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch 2 times, most recently from964bfe9 to494afa9CompareOctober 29, 2024 10:23
Copy link
Contributor

@spikecurtisspikecurtis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

A few nits inline, but I don't need to review again

_ = testutil.RequireRecvCtx(ctx, t, ch)
// If we don't cancel the context, the coordinator close will wait until the
// peer request loop finishes, which will be after the timeout
peerCtxCancel()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

Yeah, PGCoord is more aggressive with closing things down, forcibly booting anything still connected because it has contexts plumbed thru for background tasks like heartbeats. The AGPL coordinator is considerably simpler and has no coordinator-scoped context.

@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from494afa9 tocdb4235CompareOctober 29, 2024 13:35
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch froma45a43c to744633fCompareNovember 1, 2024 03:02
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch fromcdb4235 to7d0a2b6CompareNovember 1, 2024 03:02
@ethanndicksonethanndicksonforce-pushed the09-25-chore_add_db_query_to_retrieve_workspaces_their_agents branch 2 times, most recently from54ceea2 to8be52edCompareNovember 1, 2024 03:18
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from7d0a2b6 to33d6628CompareNovember 1, 2024 03:18
@ethanndicksonethanndickson changed the base branch from09-25-chore_add_db_query_to_retrieve_workspaces_their_agents tographite-base/14847November 1, 2024 03:36
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from33d6628 to7be63f5CompareNovember 1, 2024 03:36
@ethanndicksonethanndickson changed the base branch fromgraphite-base/14847 tomainNovember 1, 2024 03:37
@ethanndicksonethanndicksonforce-pushed the09-27-feat_add_workspaceupdates_rpc branch from7be63f5 tob509099CompareNovember 1, 2024 03:37
@ethanndicksonethanndickson merged commitb1298a3 intomainNov 1, 2024
28 checks passed
@ethanndicksonethanndickson deleted the 09-27-feat_add_workspaceupdates_rpc branchNovember 1, 2024 03:53
@github-actionsgithub-actionsbot locked and limited conversation to collaboratorsNov 1, 2024
Sign up for freeto subscribe to this conversation on GitHub. Already have an account?Sign in.
Reviewers

@spikecurtisspikecurtisspikecurtis approved these changes

@sreyasreyaAwaiting requested review from sreya

Assignees

@ethanndicksonethanndickson

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add tailnet Coordinate authorization for users to access their own workspaces Add new WorkspaceUpdates tailnet RPC
3 participants
@ethanndickson@spikecurtis@matifali
[8]ページ先頭
©2009-2025 Movatter.jp