I'm enabling topic authorization on the production bus

[Aurelien Bompard]

Hey folks!

After a lot of asking around and quite a bit of testing on staging, I'm
ready to enable topic authorization on production. If your application does
not declare the `sent_topics` regexp in Ansible, it will only be allowed to
publish on topics that start with
`org.fedoraproject.{env}.{rabbit_username}.`.

This is just a heads-up. I'll watch the rabbitmq logs closely to see if
there are permission refused errors, in which case I'll try to contact the
app owner.

Fingers crossed! In theory all goes well :-D

Aurélien

[Aurelien Bompard]

Done. The following users are not protected by ACLs (which means they can
send to any topics):
- notifs-web and notifs-backend, because we'll remove the old FMN soonish
- alt-src: I couldn't contact the owner (Siteshwar?). Related to CentOS
Stream. I tried to contact Brian Stinston.
- coreos: Same, couldn't contact the owner of this account.
- fedora-build-checks: Same story, I contacted Tim who redirected me to
msrb, but got no response.

All the other accounts are only allowed to send to the topics they have
defined in Ansible.
This opens the door to letting external services publish to our message
bus, since we can make sure they can only publish to their namespace.
Please tell me if you see anything erroring out when you publish messages,
I'll look at the logs which, helpfully, tell us when publishing to a topic
is refused.
Thanks!

Aurélien

[Kevin Fenzi]

Thanks for driving this forward!

kevin

[Ben Cotton]

On Mon, Jul 10, 2023 at 11:44 AM Aurelien Bompard
<abompard(a)fedoraproject.org&gt; wrote:
>  All the other accounts are only allowed to send to the topics they have defined in
> Ansible.
>  This opens the door to letting external services publish to our message bus, since we can
> make sure they can only publish to their namespace. 
Awesome! When we're ready to start letting external services board the
bus, that would be a great Community Blog post.

-- 
Ben Cotton (he/him)
TZ=America/Indiana/Indianapolis
https://fedoraproject.org/wiki/User:Bcotton

[Aurelien Bompard]

So, something broke, I forgot that the bodhi user also publishes to the
org.fedoraproject.{env}.pungi.
I fixed that now but there were quite a few messages rejected during my
night. It may be necessary to restart the compose.

Aurélien

Le lun. 10 juil. 2023 à 17:43, Aurelien Bompard <abompard(a)fedoraproject.org&gt;
a écrit :

>  Done. The following users are not protected by ACLs (which means they
> can
>  send to any topics):
>  - notifs-web and notifs-backend, because we'll remove the old FMN soonish
>  - alt-src: I couldn't contact the owner (Siteshwar?). Related to CentOS
>  Stream. I tried to contact Brian Stinston.
>  - coreos: Same, couldn't contact the owner of this account.
>  - fedora-build-checks: Same story, I contacted Tim who redirected me to
>  msrb, but got no response.
>
>  All the other accounts are only allowed to send to the topics they have
>  defined in Ansible.
>  This opens the door to letting external services publish to our message
>  bus, since we can make sure they can only publish to their namespace.
>  Please tell me if you see anything erroring out when you publish messages,
>  I'll look at the logs which, helpfully, tell us when publishing to a topic
>  is refused.
>  Thanks!
>
>  Aurélien
>

[Kevin Fenzi]

On Tue, Jul 11, 2023 at 08:42:31AM +0200, Aurelien Bompard wrote:
>  So, something broke, I forgot that the bodhi user also publishes to
> the
>  org.fedoraproject.{env}.pungi.
>  I fixed that now but there were quite a few messages rejected during my
>  night. It may be necessary to restart the compose. 
All the composes seem to have finished ok, or failed and will be run
again tonight. ;) 

kevin