Are these bugs in 5.12?

KendallChenoweth · September 12, 2019, 6:54am

Using sensuctl 5.12, you can have a role-binding and delete the defined role without an error.

Using sensuctl 5.12, you can also delete an asset in use by a check.

Using sensuctl 5.12, you can create a check with an asset that doesn’t exist.

Using 5.9, the following rules allow me “resolve” and “clear silence” from the dashboard (under events).

sensuctl role create local-admin --verb get,list,create,update,delete --resource assets,checks,entities,events,filters,hooks,silenced --namespace linux
ensuctl role-binding create local-admin --role=local-admin --group=linux --namespace linux

Using 5.12, I get an error

jspaleta · September 12, 2019, 6:38pm

Hey,
quick check in for the things that I can asnwer for the asset issues you bring up in 5.12…

The need to have to adjust your checks when you delete an asset is a known issue:
https://docs.sensu.io/sensu-go/latest/release-notes/#5-12-0-release-notes

Not sure if there is a long term plan to automatically remove asset references, but personally I think its bad idea to do by default. It’s a bit dangerous to do that on behalf of the user by default…because some workflows people are using with cm or gitOps approach to manage resources may require purging a resource before uploaded a new version if it. If deleting an asset caused references to the asset to be deleted in other resources may cause huge problems for people using automated workflows.

And in general requiring referenced named resources like an asset to to exist before a check could be uploaded would actually be an anti-feature as it will make it much harder to automate resource deployment because you’d have to deploy resources in a specific order.

There maybe room here for a high level validation feature to validate the connections between resources for an entire namespace that can be run after all changes are made in a namespace. But validating connections like that when editting a single resource will be problematic as it starts requiring people to have to be very careful with the ordering they use to change resources.

-jef

KendallChenoweth · September 12, 2019, 7:28pm

Asset dependency management is complicated, if only because it’s not always clear what the right thing to do is. I agree that if a check using an asset is deleted, that the asset should stick around, because who knows what’s supposed to happen next.

I’m more concerned that you can delete a resource (e.g. role or asset) in use by something else, causing something else to break in the future.

I can see your argument that a user’s workflow may want to delete and recreate an object (perhaps in use by something else).

A solution for this outside of Sensu is to have a validation script (perhaps invoked by cm) that all your dependencies exist.

Topic		Replies	Views
(almost) better RBAC access messages in Sensu 5.19.1 Sensu Go 5191	1	288	April 15, 2020
Checks using asset not assigned, but named similarly Sensu Go sensu-go , assets	2	340	March 1, 2022
What's New in Sensu - April 16, 2020 Webinars	3	718	April 17, 2020
Is it possible to implement asset disable? Sensu Go	4	659	October 1, 2019
SensuGo - check not exist but the event still occurring Sensu Go	12	649	December 14, 2019

Are these bugs in 5.12?

Related topics