Repository navigation
feat(authz): define 3-tier atespace authorization model and node restriction - #1233
Merged
Taahir Ahmed (ahmedtd) merged 6 commits intoSep 11, 2026
Merged
Conversation
- Establish 3-tier Atespace governance: owner, editor, viewer - Add cluster-level superadmin inheritance (owner from parent_cluster) - Restrict template and actor operations to inherit from parent Atespace - Implement Node Restriction graph (host_node from scheduled_worker) for credential minting - Add tests covering cluster admin propagation, atespace isolation, templates, actors, and node restriction (80/80 checks passing)
Shruti Nair (SHRUTI6991)
changed the title
Shruti Nair (SHRUTI6991)
marked this pull request as ready for review
September 8, 2026 21:27
Collaborator
Author
|
/assign Taahir Ahmed (@ahmedtd) |
Taahir Ahmed (ahmedtd)
previously approved these changes
Sep 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Working on #1563
Overview
This PR defines the initial OpenFGA authorization model (
internal/authz/model.fga) and comprehensive test suite (internal/authz/model_test.fga.yaml) for Substrate control-plane and data-plane operations.Key Features & Design
Global Cluster Scope (Singleton):
cluster:root).owner: Can create Atespaces (can_create_atespace), and automatically inheritsowneracross all child Atespaces viaowner from parent_cluster.viewer: Read-only access (can_get), allowing cluster-level inspection/listing, and automatically inheritsvieweracross all child Atespaces viaviewer from parent_cluster.3-Tier Atespace Governance:
owner: Full administrative control; can set policy (can_set_policy), get policy (can_get_policy), create templates/actors, update, and delete the Atespace (can_delete).editor: Can create templates/actors (can_create_actor,can_create_actor_template), get/update resources and the Atespace (can_update,can_get).viewer: Read-only access (can_get,can_get_policy). All subjects require explicit authentication (no wildcarduser:*).Direct Binding Boundaries:
actorandactor_templateinstances derive their access directly fromparent_atespace.Node Restriction for Credential Minting:
scheduled_worker: [worker],host_node: host_node from scheduled_worker).can_mint_ateom_actor_credentialis restricted exclusively to the activehost_noderunning the scheduled worker pod.Lifecycle Permissions:
can_resume: Ingress routers or Atespace editors can resume actors.can_suspend: Actors' workload identities or Atespace editors can trigger suspend.Naming Conventions:
owner,viewer,parent_cluster,host_node).can_prefix (can_get,can_set_policy,can_create_actor,can_mint_ateom_actor_credential).Verification