From 1691c6c5c29112c3f255270b629db115000a7bc0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fredrik=20Adel=C3=B6w?= Date: Mon, 28 Mar 2022 16:32:51 +0200 Subject: [PATCH] Make User and Group not default allowed by rules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Fredrik Adelöw --- .changeset/beige-baboons-walk.md | 7 +++ .changeset/clean-lions-taste.md | 52 +++++++++++++++++++ docs/integrations/github/org.md | 2 + docs/integrations/ldap/org.md | 2 + .../templates/default-app/app-config.yaml.hbs | 2 +- packages/integration/CHANGELOG.md | 2 + .../catalog-backend-module-msgraph/README.md | 2 - plugins/catalog-backend/CHANGELOG.md | 2 + 8 files changed, 68 insertions(+), 3 deletions(-) create mode 100644 .changeset/beige-baboons-walk.md create mode 100644 .changeset/clean-lions-taste.md diff --git a/.changeset/beige-baboons-walk.md b/.changeset/beige-baboons-walk.md new file mode 100644 index 0000000000..a5b424a489 --- /dev/null +++ b/.changeset/beige-baboons-walk.md @@ -0,0 +1,7 @@ +--- +'@backstage/integration': patch +'@backstage/plugin-catalog-backend': patch +'@backstage/plugin-catalog-backend-module-msgraph': patch +--- + +Clarify that config locations that emit User and Group kinds now need to declare so in the `catalog.locations.[].rules` diff --git a/.changeset/clean-lions-taste.md b/.changeset/clean-lions-taste.md new file mode 100644 index 0000000000..d4179fa39a --- /dev/null +++ b/.changeset/clean-lions-taste.md @@ -0,0 +1,52 @@ +--- +'@backstage/create-app': patch +--- + +Made `User` and `Group` entity kinds not permitted by the default +`catalog.rules` config. + +The effect of this is that after creating a new Backstage repository, its +catalog no longer permits regular users to register `User` or `Group` entities +using the Backstage interface. Additionally, if you have config locations that +result in `User` or `Group` entities, you need to add those kinds to its own +specific rules: + +```yaml +catalog: + locations: + # This applies for example to url type locations + - type: url + target: https://example.com/org.yaml + rules: + allow: [User, Group] + # But also note that this applies to ALL org location types! + - type: github-org + target: https://github.com/my-org-name + rules: + allow: [User, Group] +``` + +This rule change does NOT affect entity providers, only things that are emitted +by entity processors. + +We recommend that this change is applied to your own Backstage repository, since +it makes it impossible for regular end users to affect your org data through +e.g. YAML files. To do so, remove the two kinds from the default rules in your config: + +```diff + catalog: + rules: +- - allow: [Component, System, API, Group, User, Resource, Location] ++ - allow: [Component, System, API, Resource, Location] +``` + +And for any location that in any way results in org data being ingested, add the corresponding rule to it: + +```diff + catalog: + locations: + - type: github-org + target: https://github.com/my-org-name ++ rules: ++ allow: [User, Group] +``` diff --git a/docs/integrations/github/org.md b/docs/integrations/github/org.md index 975df2e555..7d810ace1f 100644 --- a/docs/integrations/github/org.md +++ b/docs/integrations/github/org.md @@ -31,6 +31,8 @@ catalog: locations: - type: github-org target: https://github.com/my-org-name + rules: + allow: [User, Group] ``` If Backstage is configured to use GitHub Apps authentication you must grant diff --git a/docs/integrations/ldap/org.md b/docs/integrations/ldap/org.md index f7f4e25b1a..14c31c50e4 100644 --- a/docs/integrations/ldap/org.md +++ b/docs/integrations/ldap/org.md @@ -365,4 +365,6 @@ catalog: locations: - type: ldap-org target: ldaps://ds.example.net + rules: + allow: [User, Group] ``` diff --git a/packages/create-app/templates/default-app/app-config.yaml.hbs b/packages/create-app/templates/default-app/app-config.yaml.hbs index 02139f8084..380d2a765d 100644 --- a/packages/create-app/templates/default-app/app-config.yaml.hbs +++ b/packages/create-app/templates/default-app/app-config.yaml.hbs @@ -85,7 +85,7 @@ catalog: entityFilename: catalog-info.yaml pullRequestBranchName: backstage-integration rules: - - allow: [Component, System, API, Group, User, Resource, Location] + - allow: [Component, System, API, Resource, Location] locations: # Backstage example components - type: url diff --git a/packages/integration/CHANGELOG.md b/packages/integration/CHANGELOG.md index 7df271fdd4..9c226ff1d5 100644 --- a/packages/integration/CHANGELOG.md +++ b/packages/integration/CHANGELOG.md @@ -237,6 +237,8 @@ locations: - type: github-multi-org target: https://github.myorg.com + rules: + allow: [User, Group] processors: githubMultiOrg: diff --git a/plugins/catalog-backend-module-msgraph/README.md b/plugins/catalog-backend-module-msgraph/README.md index 741e378fd4..bf23e93770 100644 --- a/plugins/catalog-backend-module-msgraph/README.md +++ b/plugins/catalog-backend-module-msgraph/README.md @@ -141,8 +141,6 @@ catalog: locations: - type: microsoft-graph-org target: https://graph.microsoft.com/v1.0 - # If you catalog doesn't allow to import Group and User entities by - # default, allow them here rules: - allow: [Group, User] … diff --git a/plugins/catalog-backend/CHANGELOG.md b/plugins/catalog-backend/CHANGELOG.md index 89e0408cc8..5506c649c4 100644 --- a/plugins/catalog-backend/CHANGELOG.md +++ b/plugins/catalog-backend/CHANGELOG.md @@ -1394,6 +1394,8 @@ locations: - type: github-multi-org target: https://github.myorg.com + rules: + allow: [User, Group] processors: githubMultiOrg: