POST SyncServiceAccount API with empty role removes unrestricted permissions

[chunyap-lim]

Issue Summary:

POST SyncServiceAccount API with empty role removes unrestricted permissions.

Cloud Provider(s):

NA

Environment:

On AWS ECS.

Feature Area:

Role Sync - SyncServiceAccount

Description:

When isDisableRoleSyncWhenSavingServiceAccounts flag is enabled in Front50, saving a service account will result in removing unrestricted permissions in Fiat. User got permissions error in the pipeline execution until the next scheduled full role sync to repopulate these unrestricted permissions.

Steps to Reproduce:

Clouddriver account config (with no specified permissions set):

aws:
  enabled: true
  accounts:
  - name: aws-account
    accountId: 1234567890123
    assumeRole: spinnaker-role
    regions:
      - name: ap-southeast-1

1. Check user authorization. accounts permission is populated.

request:

GET {{FIAT_HOST}}/authorize/<user>

response:

{
    "name": "chunyap.lim",
    "accounts": [
        {
            "name": "aws-account",
            "authorizations": [
                "READ",
                "WRITE",
                "EXECUTE",
                "CREATE"
            ]
        }
    ],
    "applications": [...],
    "serviceAccounts": [...],
    "roles": [...],
    "buildServices": [...]
    ...
}

2. Run SyncServiceAccount with empty role

Request:

POST -H 'Content-Type: application/json' -d '[]' {{FIAT_HOST}}/roles/sync/serviceAccount/<serviceaccount>

3. Check user authorization again, accounts permission IS GONE.

Request:

GET {{FIAT_HOST}}/authorize/<user>

Response:

{
    "name": "chunyap.lim",
    "accounts": [],
    "applications": [...],
    "serviceAccounts": [...],
    "roles": [...],
    "buildServices": [...]
    ...
}

Additional Details:

permissionsRepository.getAllByRoles([]) function will return UNRESTRICTED_USER role. Running permissionsResolver.resolveResources on UNRESTRICTED_USER will not resolve any unrestricted permissions, and UNRESTRICTED_USER with empty permissions is updated into the cache. In other words, the unrestricted permissions are wiped. In the full role sync process, UNRESTRICTED_USER is handled differently by calling permissionsResolver.resolveUnrestrictedUser instead.

[spinnakerbot]

This issue hasn't been updated in 45 days, so we are tagging it as 'stale'. If you want to remove this label, comment:

@spinnakerbot remove-label stale

[chunyap-lim]

@spinnakerbot remove-label stale