enterprise/lifecycle: implement Object Lifecycle Management (#13265)#20015
enterprise/lifecycle: implement Object Lifecycle Management (#13265)#20015atereshkin wants to merge 55 commits intogoauthentik:mainfrom
Conversation
…ption to the open review list
…ta format used elsewhere in authentik
Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Tana M Berry <tanamarieberry@yahoo.com> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview for authentik-integrations ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
| @action( | ||
| detail=False, | ||
| methods=["get"], | ||
| url_path=r"open", |
There was a problem hiding this comment.
I wanted to emphasize that it's not the generic list endpoint, but a specialized one just for getting open reviews. There's (currently) no reason to retrieve the closed (let alone canceled) reviews, so I figured it should be emphasized in the API. Do you think a generic one with a filter would be better?
| return user in self.rule.get_reviewers() | ||
|
|
||
|
|
||
| class Attestation(SerializerModel): |
There was a problem hiding this comment.
| class Attestation(SerializerModel): | |
| class LifecycleReview(SerializerModel): |
After discussion with the team, we'd like to name this "review", but this causes a conflict with the above model. Maybe rename the above one as LifecycleStatus or LifecycleReviewStatus
There was a problem hiding this comment.
@rissson not a fan of these tbh, because it's not just a status storage, but a "review round". I.e. it's not immediately clear from either of these names why an object would have multiple review statuses rather one. How about ReviewCycle or ReviewRound? Or maybe LifecycleIteration?
Also, what about the UI? Is it still OK to call that section "Access reviews" (regardless of how we call the model)?
| apply_lifecycle_rule.send_with_options( | ||
| args=(instance.id,), | ||
| rel_obj=instance, | ||
| ) |
There was a problem hiding this comment.
Usually when we use rel_obj we also have a section on the frontend that will show associated tasks, because they don't show up by default in the "System tasks" page.
There was a problem hiding this comment.
@rissson Do you think it would be useful to have that here? Or maybe we should just remove rel_obj? I was thinking we could eventually show open reviews when you expand a lifecycle rule in the list.
… page not matching exactly the full list in Applications
Co-authored-by: Jens L. <jens@beryju.org> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Jens L. <jens@beryju.org> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Jens L. <jens@beryju.org> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Jens L. <jens@beryju.org> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Jens L. <jens@beryju.org> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Jens L. <jens@beryju.org> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Jens L. <jens@beryju.org> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
Co-authored-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Signed-off-by: Alexander Tereshkin <96586+atereshkin@users.noreply.github.com>
4 participants
Details
This implements Object Lifecycle Management: a way to schedule and track periodic reviews for Applications, Groups and Roles (and eventually more objects).
On the backend, a new app is added called "enterprise/lifecycle".
On the frontend, 3 new screens are added: Events -> Lifecycle Rules, Events -> Access Reviews and the Lifecycle tab on Application/Group/Role detail page. Most of the code is in admin/lifecycle
closes #13265
Checklist
ak test authentik/)make lint-fix)If an API change has been made
make gen-build)If changes to the frontend have been made
make web)If applicable
make docs)