Skip to content

Commit c7c444c

Browse files
emargetisemargetis
committed
replacing policy with access graph
1 parent cf54771 commit c7c444c

File tree

23 files changed

+68
-67
lines changed

23 files changed

+68
-67
lines changed

‎api/client/webclient/webconfig.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,9 +100,9 @@ type WebConfig struct {
100100
// IsIGSEnabled is true if [Features.IdentityGovernance] = true
101101
// Deprecated, use entitlements
102102
IsIGSEnabled bool `json:"isIgsEnabled"`
103-
// IsPolicyEnabled is true if [Features.Policy] = true
103+
// IsAccessGraphEnabled is true if [Features.Policy] = true
104104
// Deprecated, use entitlements
105-
IsPolicyEnabled bool `json:"isPolicyEnabled"`
105+
IsAccessGraphEnabled bool `json:"isAcessGraphEnabled"`
106106
// TODO (avatus) delete in v18
107107
// IsPolicyRoleVisualizerEnabled is the graph visualizer for diffs made
108108
// when editing roles in the Web UI. This defaults to true, but has an environment

‎e‎

Submodule e updated from b8e7edf to 97d48b4

‎entitlements/entitlements.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,6 @@ const (
4545
OIDC EntitlementKind = "OIDC"
4646
OktaSCIM EntitlementKind = "OktaSCIM"
4747
OktaUserSync EntitlementKind = "OktaUserSync"
48-
Policy EntitlementKind = "Policy"
4948
SAML EntitlementKind = "SAML"
5049
SessionLocks EntitlementKind = "SessionLocks"
5150
UnrestrictedManagedUpdates EntitlementKind = "UnrestrictedManagedUpdates"
@@ -54,14 +53,15 @@ const (
5453
LicenseAutoUpdate EntitlementKind = "LicenseAutoUpdate"
5554
AccessGraphDemoMode EntitlementKind = "AccessGraphDemoMode"
5655
ClientIPRestrictions EntitlementKind = "ClientIPRestrictions"
56+
AccessGraph EntitlementKind = "AccessGraph"
5757
)
5858

5959
// AllEntitlements returns all Entitlements; should be 1:1 with the const declared above.
6060
var AllEntitlements = []EntitlementKind{
6161
AccessLists, AccessMonitoring, AccessRequests, App, CloudAuditLogRetention, DB, Desktop, DeviceTrust,
6262
ExternalAuditStorage, FeatureHiding, HSM, Identity, JoinActiveSessions, K8s, MobileDeviceManagement, OIDC, OktaSCIM,
63-
OktaUserSync, Policy, SAML, SessionLocks, UnrestrictedManagedUpdates, UpsellAlert, UsageReporting, LicenseAutoUpdate, AccessGraphDemoMode,
64-
ClientIPRestrictions,
63+
OktaUserSync, SAML, SessionLocks, UnrestrictedManagedUpdates, UpsellAlert, UsageReporting, LicenseAutoUpdate, AccessGraphDemoMode,
64+
ClientIPRestrictions, AccessGraph,
6565
}
6666

6767
// BackfillFeatures ensures entitlements are backwards compatible.
@@ -82,7 +82,7 @@ func BackfillFeatures(features *proto.Features) {
8282
features.Entitlements[string(JoinActiveSessions)] = &proto.EntitlementInfo{Enabled: features.GetJoinActiveSessions()}
8383
features.Entitlements[string(MobileDeviceManagement)] = &proto.EntitlementInfo{Enabled: features.GetMobileDeviceManagement()}
8484
features.Entitlements[string(OIDC)] = &proto.EntitlementInfo{Enabled: features.GetOIDC()}
85-
features.Entitlements[string(Policy)] = &proto.EntitlementInfo{Enabled: features.GetPolicy().GetEnabled()}
85+
features.Entitlements[string(AccessGraph)] = &proto.EntitlementInfo{Enabled: features.GetAccessGraph()}
8686
features.Entitlements[string(SAML)] = &proto.EntitlementInfo{Enabled: features.GetSAML()}
8787
features.Entitlements[string(K8s)] = &proto.EntitlementInfo{Enabled: features.GetKubernetes()}
8888
features.Entitlements[string(App)] = &proto.EntitlementInfo{Enabled: features.GetApp()}

‎entitlements/entitlements_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,6 @@ func TestBackfillFeatures(t *testing.T) {
8787
string(OIDC): {Enabled: true},
8888
string(OktaSCIM): {Enabled: true},
8989
string(OktaUserSync): {Enabled: true},
90-
string(Policy): {Enabled: true},
9190
string(SAML): {Enabled: true},
9291
string(SessionLocks): {Enabled: true},
9392
string(UpsellAlert): {Enabled: true},
@@ -96,6 +95,7 @@ func TestBackfillFeatures(t *testing.T) {
9695
string(AccessGraphDemoMode): {Enabled: true},
9796
string(UnrestrictedManagedUpdates): {Enabled: true},
9897
string(ClientIPRestrictions): {Enabled: true},
98+
string(AccessGraph): {Enabled: true},
9999
},
100100
},
101101
expected: map[string]*proto.EntitlementInfo{
@@ -117,7 +117,6 @@ func TestBackfillFeatures(t *testing.T) {
117117
string(OIDC): {Enabled: true},
118118
string(OktaSCIM): {Enabled: true},
119119
string(OktaUserSync): {Enabled: true},
120-
string(Policy): {Enabled: true},
121120
string(SAML): {Enabled: true},
122121
string(SessionLocks): {Enabled: true},
123122
string(UpsellAlert): {Enabled: true},
@@ -126,6 +125,7 @@ func TestBackfillFeatures(t *testing.T) {
126125
string(AccessGraphDemoMode): {Enabled: true},
127126
string(UnrestrictedManagedUpdates): {Enabled: true},
128127
string(ClientIPRestrictions): {Enabled: true},
128+
string(AccessGraph): {Enabled: true},
129129
},
130130
},
131131
{
@@ -194,9 +194,9 @@ func TestBackfillFeatures(t *testing.T) {
194194
string(OIDC): {Enabled: true},
195195
string(OktaSCIM): {Enabled: true},
196196
string(OktaUserSync): {Enabled: true},
197-
string(Policy): {Enabled: true},
198197
string(SAML): {Enabled: true},
199198
string(SessionLocks): {Enabled: true},
199+
string(AccessGraph): {Enabled: true},
200200
// defaults, no legacy equivalent
201201
string(UsageReporting): {Enabled: false},
202202
string(UpsellAlert): {Enabled: false},
@@ -270,7 +270,7 @@ func TestBackfillFeatures(t *testing.T) {
270270
string(K8s): {Enabled: true},
271271
string(MobileDeviceManagement): {Enabled: true},
272272
string(OIDC): {Enabled: true},
273-
string(Policy): {Enabled: true},
273+
string(AccessGraph): {Enabled: true},
274274
string(SAML): {Enabled: true},
275275

276276
// defaults, no legacy equivalent

‎lib/auth/clusterconfig/clusterconfigv1/service.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -931,7 +931,7 @@ func (s *Service) GetClusterAccessGraphConfig(ctx context.Context, _ *clustercon
931931
}
932932

933933
// If the policy feature is disabled in the license, return a disabled response. if cloud, return the response to allow demo mode enabling
934-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
934+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
935935
return &clusterconfigpb.GetClusterAccessGraphConfigResponse{
936936
AccessGraph: &clusterconfigpb.AccessGraphConfig{
937937
Enabled: false,
@@ -1032,7 +1032,7 @@ func (s *Service) UpdateAccessGraphSettings(ctx context.Context, req *clustercon
10321032
return nil, trace.Wrap(err)
10331033
}
10341034

1035-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
1035+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph && !modules.GetModules().Features().Cloud {
10361036
return nil, trace.AccessDenied("access graph is feature isn't enabled")
10371037
}
10381038

@@ -1076,7 +1076,7 @@ func (s *Service) UpsertAccessGraphSettings(ctx context.Context, req *clustercon
10761076
return nil, trace.Wrap(err)
10771077
}
10781078

1079-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph {
1079+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph {
10801080
return nil, trace.AccessDenied("access graph is feature isn't enabled")
10811081
}
10821082

@@ -1120,7 +1120,7 @@ func (s *Service) ResetAccessGraphSettings(ctx context.Context, _ *clusterconfig
11201120
return nil, trace.Wrap(err)
11211121
}
11221122

1123-
if !modules.GetModules().Features().GetEntitlement(entitlements.Policy).Enabled && !modules.GetModules().Features().AccessGraph {
1123+
if !modules.GetModules().Features().GetEntitlement(entitlements.AccessGraph).Enabled && !modules.GetModules().Features().AccessGraph {
11241124
return nil, trace.AccessDenied("access graph is feature isn't enabled")
11251125
}
11261126

‎lib/auth/clusterconfig/clusterconfigv1/service_test.go‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1870,7 +1870,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
18701870
m := modulestest.Modules{
18711871
TestFeatures: modules.Features{
18721872
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
1873-
entitlements.Policy: {Enabled: true},
1873+
entitlements.AccessGraph: {Enabled: true},
18741874
},
18751875
},
18761876
}
@@ -1895,7 +1895,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
18951895
m := modulestest.Modules{
18961896
TestFeatures: modules.Features{
18971897
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
1898-
entitlements.Policy: {Enabled: true},
1898+
entitlements.AccessGraph: {Enabled: true},
18991899
},
19001900
},
19011901
}
@@ -1920,7 +1920,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
19201920
m := modulestest.Modules{
19211921
TestFeatures: modules.Features{
19221922
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
1923-
entitlements.Policy: {Enabled: true},
1923+
entitlements.AccessGraph: {Enabled: true},
19241924
},
19251925
},
19261926
}
@@ -2078,7 +2078,7 @@ func TestUpdateAccessGraphSettings(t *testing.T) {
20782078
m := modulestest.Modules{
20792079
TestFeatures: modules.Features{
20802080
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
2081-
entitlements.Policy: {Enabled: true},
2081+
entitlements.AccessGraph: {Enabled: true},
20822082
},
20832083
},
20842084
}
@@ -2203,7 +2203,7 @@ func TestUpsertAccessGraphSettings(t *testing.T) {
22032203
m := modulestest.Modules{
22042204
TestFeatures: modules.Features{
22052205
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
2206-
entitlements.Policy: {Enabled: true},
2206+
entitlements.AccessGraph: {Enabled: true},
22072207
},
22082208
},
22092209
}
@@ -2297,7 +2297,7 @@ func TestResetAccessGraphSettings(t *testing.T) {
22972297
m := modulestest.Modules{
22982298
TestFeatures: modules.Features{
22992299
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
2300-
entitlements.Policy: {Enabled: true},
2300+
entitlements.AccessGraph: {Enabled: true},
23012301
},
23022302
},
23032303
}

‎lib/auth/grpcserver_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5600,7 +5600,7 @@ func TestGetAccessGraphConfig(t *testing.T) {
56005600
modulestest.SetTestModules(t, modulestest.Modules{
56015601
TestFeatures: modules.Features{
56025602
Entitlements: map[entitlements.EntitlementKind]modules.EntitlementInfo{
5603-
entitlements.Policy: {Enabled: true},
5603+
entitlements.AccessGraph: {Enabled: true},
56045604
},
56055605
},
56065606
})

‎lib/modules/modules.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ type Features struct {
7979
// AccessGraph enables the usage of access graph.
8080
// NOTE: this is a legacy flag that is currently used to signal
8181
// that Access Graph integration is *enabled* on a cluster.
82-
// *Access* to the feature is gated on the `Policy` flag.
82+
// *Access* to the feature is gated on the `AccessGraph` flag.
8383
// TODO(justinas): remove this field once "TAG enabled" status is moved to a resource in the backend.
8484
AccessGraph bool
8585
// AccessMonitoringConfigured contributes to the enablement of access monitoring.
@@ -168,7 +168,7 @@ func setLegacyLogic(protoF *proto.Features, f Features) {
168168
CreateLimit: f.GetEntitlement(entitlements.AccessLists).Limit,
169169
}
170170
protoF.Policy = &proto.PolicyFeature{
171-
Enabled: f.GetEntitlement(entitlements.Policy).Enabled,
171+
Enabled: f.GetEntitlement(entitlements.AccessGraph).Enabled,
172172
}
173173
}
174174

‎lib/modules/modules_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,6 @@ func TestFeatures_ToProto(t *testing.T) {
156156
string(entitlements.OIDC): {Enabled: true},
157157
string(entitlements.OktaSCIM): {Enabled: true},
158158
string(entitlements.OktaUserSync): {Enabled: true},
159-
string(entitlements.Policy): {Enabled: true},
160159
string(entitlements.SAML): {Enabled: true},
161160
string(entitlements.SessionLocks): {Enabled: true},
162161
string(entitlements.UpsellAlert): {Enabled: true},
@@ -165,6 +164,7 @@ func TestFeatures_ToProto(t *testing.T) {
165164
string(entitlements.AccessGraphDemoMode): {Enabled: true},
166165
string(entitlements.UnrestrictedManagedUpdates): {Enabled: true},
167166
string(entitlements.ClientIPRestrictions): {Enabled: true},
167+
string(entitlements.AccessGraph): {Enabled: true},
168168
},
169169
// Legacy Fields; remove in v18
170170
Kubernetes: true,
@@ -234,7 +234,6 @@ func TestFeatures_ToProto(t *testing.T) {
234234
entitlements.OIDC: {Enabled: true, Limit: 0},
235235
entitlements.OktaSCIM: {Enabled: true, Limit: 0},
236236
entitlements.OktaUserSync: {Enabled: true, Limit: 0},
237-
entitlements.Policy: {Enabled: true, Limit: 0},
238237
entitlements.SAML: {Enabled: true, Limit: 0},
239238
entitlements.SessionLocks: {Enabled: true, Limit: 0},
240239
entitlements.UpsellAlert: {Enabled: true, Limit: 0},
@@ -243,6 +242,7 @@ func TestFeatures_ToProto(t *testing.T) {
243242
entitlements.AccessGraphDemoMode: {Enabled: true, Limit: 0},
244243
entitlements.UnrestrictedManagedUpdates: {Enabled: true, Limit: 0},
245244
entitlements.ClientIPRestrictions: {Enabled: true, Limit: 0},
245+
entitlements.AccessGraph: {Enabled: true, Limit: 0},
246246
},
247247
}
248248

‎lib/srv/discovery/access_graph_aws.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -344,7 +344,7 @@ func (s *Server) initializeAndWatchAccessGraph(ctx context.Context, reloadCh <-c
344344
)
345345

346346
clusterFeatures := s.Config.ClusterFeatures()
347-
policy := modules.GetProtoEntitlement(&clusterFeatures, entitlements.Policy)
347+
policy := modules.GetProtoEntitlement(&clusterFeatures, entitlements.AccessGraph)
348348
if !clusterFeatures.AccessGraph && !policy.Enabled {
349349
return trace.Wrap(errTAGFeatureNotEnabled)
350350
}
@@ -646,7 +646,7 @@ func (s *Server) startCloudtrailPoller(ctx context.Context, reloadCh <-chan stru
646646
const semaphoreName = "access_graph_aws_cloudtrail_sync"
647647

648648
clusterFeatures := s.Config.ClusterFeatures()
649-
policy := modules.GetProtoEntitlement(&clusterFeatures, entitlements.Policy)
649+
policy := modules.GetProtoEntitlement(&clusterFeatures, entitlements.AccessGraph)
650650
if !clusterFeatures.AccessGraph && !policy.Enabled {
651651
return trace.Wrap(errTAGFeatureNotEnabled)
652652
}

0 commit comments

Comments
 (0)