stackrox · rhybrillou · Nov 8, 2022 · Sep 9, 2022 · Sep 21, 2022 · Sep 21, 2022
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -25,9 +25,19 @@ Please avoid adding duplicate information across this changelog and JIRA/doc inp
 - ROX-11592: Support to Get / Update / Mutate / Remove of groups via the `props` field and without the `props.id` field
   being set in the `/v1/groups` endpoint have been removed.
 - The unused "ComplianceRunSchedule" resource has been removed.
+- ROX-11101: As announced in 3.71.0 (ROX-8520), some permissions for permission sets are being grouped for simplification. The deprecation process will remove and replace the deprecated permissions with the replacing permission as listed below. The access level granted to the replacing permission will be the lowest among all access levels of the replaced permissions.
+  - Permission `Access` replaces the deprecated permissions `AuthProvider, Group, Licenses, User`.
+  - Permission `DeploymentExtension` replaces the deprecated permissions `Indicator, NetworkBaseline, ProcessWhitelist, Risk`.
+  - Permission `Integration` replaces the deprecated permissions `APIToken, BackupPlugins, ImageIntegration, Notifier, SignatureIntegration`.
+  - Permission `Image` replaces the deprecated permission `ImageComponent`.
+  - Note: the `Role` permission, previously announced as being grouped under `Access` remains a standalone permission.
+  - Important: As stated above, the access level granted to the replacing permission will be the lowest among all access levels of the replaced permissions. This can impact the ability of some created roles to perform their intended duty. Consolidation of the mapping from replaced resources to new ones can help assess the desired access level, should any issue be experienced.
 - ROX-13034: Central reaches out to scanner `scanner.<namespace>.svc` now to respect OpenShift's `NO_PROXY` configuration.
 
 ### Deprecated Features
+- ROX-11101: As first announced in 3.71.0 for ROX-8250, we continue to simplify access control management by grouping some permissions in permission sets. As a result:
+  - New permission `Administration` will deprecate the permissions `AllComments, Config, DebugLogs, NetworkGraphConfig, ProbeUpload, ScannerBundle, ScannerDefinitions, SensorUpgradeConfig, ServiceIdentity`.
+  - The permission `Compliance` will deprecate the permission `ComplianceRuns`.
 
 ### Technical Changes
 - ROX-11937: The Splunk integration now processes all additional standards of the compliance operator (ocp4-cis & ocp4-cis-node) correctly.

@@ -0,0 +1,129 @@
+package m110tom111
+
+import (
+	"github.com/gogo/protobuf/proto"
+	"github.com/pkg/errors"
+	"github.com/stackrox/rox/generated/storage"
+	"github.com/stackrox/rox/migrator/migrations"
+	"github.com/stackrox/rox/migrator/types"
+	"github.com/tecbot/gorocksdb"
+)
+
+const (
+	batchSize = 500
+)
+
+// Replacement resources
+const (
+	Access              = "Access"
+	DeploymentExtension = "DeploymentExtension"
+	Image               = "Image"
+	Integration         = "Integration"
+)
+
+// Replaced resources
+const (
+	APIToken             = "APIToken"
+	AuthProvider         = "AuthProvider"
+	BackupPlugins        = "BackupPlugins"
+	Group                = "Group"
+	ImageComponent       = "ImageComponent"
+	ImageIntegration     = "ImageIntegration"
+	Indicator            = "Indicator"
+	Licenses             = "Licenses"
+	NetworkBaseline      = "NetworkBaseline"
+	Notifier             = "Notifier"
+	ProcessWhitelist     = "ProcessWhitelist"
+	Risk                 = "Risk"
+	SignatureIntegration = "SignatureIntegration"
+	User                 = "User"
+)
+
+var (
+	migration = types.Migration{
+		StartingSeqNum: 110,
+		VersionAfter:   &storage.Version{SeqNum: 111},
+		Run: func(databases *types.Databases) error {
+			return migrateReplacedResourcesInPermissionSets(databases.RocksDB)
+		},
+	}
+
+	prefix = []byte("permission_sets")
+
+	replacements = map[string]string{
+		APIToken:             Integration,
+		AuthProvider:         Access,
+		BackupPlugins:        Integration,
+		Group:                Access,
+		ImageComponent:       Image,
+		ImageIntegration:     Integration,
+		Indicator:            DeploymentExtension,
+		Licenses:             Access,
+		NetworkBaseline:      DeploymentExtension,
+		Notifier:             Integration,
+		ProcessWhitelist:     DeploymentExtension,
+		Risk:                 DeploymentExtension,
+		SignatureIntegration: Integration,
+		User:                 Access,
+	}
+
+	readOpts  = gorocksdb.NewDefaultReadOptions()
+	writeOpts = gorocksdb.NewDefaultWriteOptions()
+)
+
+func init() {
+	migrations.MustRegisterMigration(migration)
+}
+
+func propagateAccessForPermission(permission string, accessLevel storage.Access, permissionSet map[string]storage.Access) storage.Access {
+	oldLevel, found := permissionSet[permission]
+	if !found {
+		return accessLevel
+	}
+	if accessLevel > oldLevel {
+		return oldLevel
+	}
+	return accessLevel
+}
+
+func migrateReplacedResourcesInPermissionSets(db *gorocksdb.DB) error {
+	it := db.NewIterator(readOpts)
+	defer it.Close()
+	wb := gorocksdb.NewWriteBatch()
+	defer wb.Destroy()
+	for it.Seek(prefix); it.ValidForPrefix(prefix); it.Next() {
+		permissions := &storage.PermissionSet{}
+		if err := proto.Unmarshal(it.Value().Data(), permissions); err != nil {
+			return errors.Wrap(err, "unable to unmarshal permission set")
+		}
+		// Copy the permission set, removing the deprecated resource permissions, and keeping the
+		// lowest access level between that of deprecated resource and their replacement
+		// for the replacement resource.
+		newPermissionSet := permissions.Clone()
+		newPermissionSet.ResourceToAccess = make(map[string]storage.Access, len(permissions.GetResourceToAccess()))
+		for resource, accessLevel := range permissions.GetResourceToAccess() {
+			if _, found := replacements[resource]; found {
+				resource = replacements[resource]
+			}
+			newPermissionSet.ResourceToAccess[resource] =
+				propagateAccessForPermission(resource, accessLevel, newPermissionSet.ResourceToAccess)
+		}
+		data, err := proto.Marshal(newPermissionSet)
+		if err != nil {
+			return errors.Wrap(err, "unable to marshal permission set")
+		}
+		wb.Put(it.Key().Copy(), data)
+		if wb.Count() == batchSize {
+			if err := db.Write(writeOpts, wb); err != nil {
+				return errors.Wrap(err, "writing to RocksDB")
+			}
+			wb.Clear()
+		}
+	}
+	if wb.Count() != 0 {
+		if err := db.Write(writeOpts, wb); err != nil {
+			return errors.Wrap(err, "writing final batch to RocksDB")
+		}
+	}
+	return nil
+}