fix(auth): Authorize admin CLI network segment creation - #4420
Conversation
Signed-off-by: Kyle Felter <kfelter@nvidia.com>
|
Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually. Contributors can view more details about this message here. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
Summary by CodeRabbit
Walkthrough
ChangesNetwork segment RBAC
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
What changedThis PR allows the admin CLI certificate principal to create a network segment through the existing guarded command. I exercised the CLI acknowledgment gate, the exact Core authorization path, creation, and readback. Scenario and setupI built and deployed revision VerificationStep 1: Preserve the cloud-unsafe acknowledgment gateWhy this step exists: The authorization change must not bypass the CLI's existing protection for operations that can diverge from the cloud database. Runnable command: API_URL=https://nico-api.example.test:1079 \
ROOT_CA_PATH=/etc/nico/ca.crt \
CLIENT_CERT_PATH=/etc/nico/admin-client.crt \
CLIENT_KEY_PATH=/etc/nico/admin-client.key \
nico-admin-cli -f json network-segment create \
--name pr4420-admin-rbac \
--id 44200000-0000-4000-8000-000000000001 \
--segment-type underlay \
--prefix 10.250.10.0/24 \
--gateway 10.250.10.1 \
--reserve-first 2 \
--mtu 1500Observed result: Why this proves the behavior: The CLI rejected the operation before an acknowledged request could reach the API. Step 2: Authorize acknowledged admin CLI creationWhy this step exists: This is the changed authorization path: Runnable command: API_URL=https://nico-api.example.test:1079 \
ROOT_CA_PATH=/etc/nico/ca.crt \
CLIENT_CERT_PATH=/etc/nico/admin-client.crt \
CLIENT_KEY_PATH=/etc/nico/admin-client.key \
nico-admin-cli --cloud-unsafe-op=verification-admin -f json \
network-segment create \
--name pr4420-admin-rbac \
--id 44200000-0000-4000-8000-000000000001 \
--segment-type underlay \
--prefix 10.250.10.0/24 \
--gateway 10.250.10.1 \
--reserve-first 2 \
--mtu 1500Observed result (selected fields from the actual JSON response): {
"id": "44200000-0000-4000-8000-000000000001",
"vpc_id": null,
"name": "pr4420-admin-rbac",
"subdomain_id": null,
"mtu": 1500,
"prefixes": [
{
"id": "52829088-445e-49b3-afee-47b8e7614c0a",
"prefix": "10.250.10.0/24",
"gateway": "10.250.10.1",
"reserve_first": 2,
"free_ip_count": 0,
"svi_ip": null,
"free_ip_count_v2": null,
"free_ip_count_saturated": false
}
],
"created": "2026-07-30T23:35:57.408955Z",
"updated": "2026-07-30T23:35:57.408955Z",
"deleted": null,
"segment_type": 2,
"flags": [1],
"config": {
"vpc_id": null,
"subdomain_id": null,
"mtu": 1500,
"segment_type": 2,
"prefixes": [
{
"id": "52829088-445e-49b3-afee-47b8e7614c0a",
"prefix": "10.250.10.0/24",
"gateway": "10.250.10.1",
"reserve_first": 2,
"free_ip_count": 0,
"svi_ip": null,
"free_ip_count_v2": null,
"free_ip_count_saturated": false
}
]
},
"version": "V1-T1785454557409047",
"state": 0
}Why this proves the behavior: The acknowledged request authenticated as the admin CLI principal, passed Core RBAC, and returned the created segment instead of Step 3: Read back the created segmentWhy this step exists: A successful create response must correspond to a persisted segment that is available through the normal CLI read path. Runnable command: API_URL=https://nico-api.example.test:1079 \
ROOT_CA_PATH=/etc/nico/ca.crt \
CLIENT_CERT_PATH=/etc/nico/admin-client.crt \
CLIENT_KEY_PATH=/etc/nico/admin-client.key \
nico-admin-cli network-segment show \
44200000-0000-4000-8000-000000000001Observed result: Why this proves the behavior: The normal read path returned the same ID and configuration after the controller advanced the segment to |
|
🌿 Preview your docs: https://nvidia-preview-pull-request-4420.docs.buildwithfern.com/infra-controller |
1 participant
Allows
nico-admin-clito callCreateNetworkSegmentafter the existing--cloud-unsafe-op=adminsafeguard by adding the admin principal to the static RBAC rule. This restores the intended admin workflow without changing Machine-a-Tron or site-agent access.Related issues
Resolves #4341
Type of Change
Breaking Changes
Testing
The focused RBAC assertion failed before the rule change and passed afterward against the exact authorization source on Linux.
Additional Notes
Full
carbide-api-coretests were not run locally because the available ARM and Linux environments could not link the repository's complete API test target; CI remains required.