Skip to content

Commit 949cf7d

Browse files
andreyaksenovandreyaksenov
committed
Config credentials
1 parent 69b09d5 commit 949cf7d

File tree

14 files changed

+267
-0
lines changed

14 files changed

+267
-0
lines changed

‎doc/code_snippets/snippets/config/instances.enabled/credentials/README.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Credentials
2+
3+
A sample application demonstrating how configure user credentials in a YAML configuration.
4+
5+
## Running
6+
7+
Start the application by executing the following command in the [config](../../../config) directory:
8+
9+
```console
10+
$ tt start credentials
11+
```

‎doc/code_snippets/snippets/config/instances.enabled/credentials/config.yaml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
credentials:
2+
users:
3+
admin:
4+
password: 'T0p_Secret_P@$$w0rd'
5+
replicator:
6+
password: 'topsecret'
7+
roles: [ replication ]
8+
storage:
9+
password: 'secret'
10+
roles: [ sharding ]
11+
sampleuser:
12+
password: '123456'
13+
roles: [ writers_space_reader ]
14+
privileges:
15+
- permissions: [ read, write ]
16+
spaces: [ books ]
17+
roles:
18+
writers_space_reader:
19+
privileges:
20+
- permissions: [ read ]
21+
spaces: [ writers ]
22+
23+
groups:
24+
group001:
25+
replicasets:
26+
replicaset001:
27+
instances:
28+
instance001:
29+
iproto:
30+
listen:
31+
- uri: '127.0.0.1:3301'
32+
33+
# Load sample data
34+
app:
35+
file: 'myapp.lua'

‎doc/code_snippets/snippets/config/instances.enabled/credentials/instances.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
instance001:

‎doc/code_snippets/snippets/config/instances.enabled/credentials/myapp.lua

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
function create_spaces()
2+
box.schema.space.create('writers')
3+
box.space.writers:format({
4+
{ name = 'id', type = 'unsigned' },
5+
{ name = 'name', type = 'string' }
6+
})
7+
box.space.writers:create_index('primary', { parts = { 'id' } })
8+
9+
box.schema.space.create('books')
10+
box.space.books:format({
11+
{ name = 'id', type = 'unsigned' },
12+
{ name = 'title', type = 'string' },
13+
{ name = 'author_id', foreign_key = { space = 'writers', field = 'id' } },
14+
})
15+
box.space.books:create_index('primary', { parts = { 'id' } })
16+
end
17+
18+
function load_data()
19+
box.space.writers:insert { 1, 'Leo Tolstoy' }
20+
box.space.writers:insert { 2, 'Fyodor Dostoevsky' }
21+
box.space.writers:insert { 3, 'Alexander Pushkin' }
22+
23+
box.space.books:insert { 1, 'War and Peace', 1 }
24+
box.space.books:insert { 2, 'Anna Karenina', 1 }
25+
box.space.books:insert { 3, 'Resurrection', 1 }
26+
box.space.books:insert { 4, 'Crime and Punishment', 2 }
27+
box.space.books:insert { 5, 'The Idiot', 2 }
28+
box.space.books:insert { 6, 'The Brothers Karamazov', 2 }
29+
box.space.books:insert { 7, 'Eugene Onegin', 3 }
30+
box.space.books:insert { 8, 'The Captain\'s Daughter', 3 }
31+
box.space.books:insert { 9, 'Boris Godunov', 3 }
32+
box.space.books:insert { 10, 'Ruslan and Ludmila', 3 }
33+
end
34+
35+
create_spaces()
36+
load_data()

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_env/README.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Credentials: environment variables
2+
3+
A sample application demonstrating how set passwords in a YAML configuration using environment variables.
4+
5+
## Running
6+
7+
Before starting instances, set the `ADMIN_PASSWORD` and `REPLICATOR_PASSWORD` environment variables, for example:
8+
9+
```console
10+
$ export ADMIN_PASSWORD='T0p_Secret_P@$$w0rd'
11+
$ export REPLICATOR_PASSWORD='topsecret'
12+
```
13+
14+
Then, start the application by executing the following command in the [config](../../../config) directory:
15+
16+
```console
17+
$ tt start credentials_context_env
18+
```

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_env/config.yaml

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
config:
2+
context:
3+
admin_password:
4+
from: env
5+
env: ADMIN_PASSWORD
6+
replicator_password:
7+
from: env
8+
env: REPLICATOR_PASSWORD
9+
10+
credentials:
11+
users:
12+
admin:
13+
password: '{{ context.admin_password }}'
14+
replicator:
15+
password: '{{ context.replicator_password }}'
16+
roles: [ replication ]
17+
18+
groups:
19+
group001:
20+
replicasets:
21+
replicaset001:
22+
instances:
23+
instance001:
24+
iproto:
25+
listen:
26+
- uri: '127.0.0.1:3301'

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_env/instances.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
instance001:

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_file/README.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Credentials: files
2+
3+
A sample application demonstrating how load passwords to a YAML configuration from files.
4+
5+
## Running
6+
7+
Start the application by executing the following command in the [config](../../../config) directory:
8+
9+
```console
10+
$ tt start credentials_context_file
11+
```

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_file/config.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
config:
2+
context:
3+
admin_password:
4+
from: file
5+
file: secrets/admin_password.txt
6+
rstrip: true
7+
replicator_password:
8+
from: file
9+
file: secrets/replicator_password.txt
10+
rstrip: true
11+
12+
credentials:
13+
users:
14+
admin:
15+
password: '{{ context.admin_password }}'
16+
replicator:
17+
password: '{{ context.replicator_password }}'
18+
roles: [ replication ]
19+
20+
groups:
21+
group001:
22+
replicasets:
23+
replicaset001:
24+
instances:
25+
instance001:
26+
iproto:
27+
listen:
28+
- uri: '127.0.0.1:3301'

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_file/instances.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
instance001:

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_file/secrets/admin_password.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
T0p_Secret_P@$$w0rd

‎doc/code_snippets/snippets/config/instances.enabled/credentials_context_file/secrets/replicator_password.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
topsecret

‎doc/concepts/configuration.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -451,5 +451,6 @@ To learn more about the persistence mechanism in Tarantool, see the :ref:`Persis
451451
configuration/configuration_etcd
452452
configuration/configuration_code
453453
configuration/configuration_connections
454+
configuration/configuration_credentials
454455
configuration/configuration_authentication
455456
.. configuration/configuration_migrating

‎doc/concepts/configuration/configuration_credentials.rst

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
.. _configuration_credentials:
2+
3+
Credentials
4+
===========
5+
6+
Tarantool enables flexible management of access to various database resources by providing specific privileges to users.
7+
You can read more about the main concepts of Tarantool access control system in the :ref:`authentication` section.
8+
9+
This topic describes how to create users and grant them the specified privileges in the :ref:`credentials <configuration_reference_credentials>` section of a YAML configuration.
10+
This might be used to create specific users used in communications between Tarantool instances.
11+
For example, such users can be created to maintain replication and sharding in a Tarantool cluster.
12+
13+
14+
.. _configuration_credentials_managing_users_roles:
15+
16+
Managing users and roles
17+
------------------------
18+
19+
You can create new or configure credentials of the existing users in the :ref:`credentials.users <configuration_reference_credentials_users>` section.
20+
In the example below, a password for the built-in 'admin' user is set:
21+
22+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
23+
:language: yaml
24+
:start-at: credentials:
25+
:end-at: T0p_Secret
26+
:dedent:
27+
28+
To assign a role to a user, use the :ref:`credentials.users.\<username\>.roles <configuration_reference_credentials_users_name_roles>` option.
29+
In this example, the 'replicator' and 'storage' users get privileges granted to the 'replication' and 'sharding' built-in roles, respectively:
30+
31+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
32+
:language: yaml
33+
:start-at: replicator:
34+
:end-at: [ sharding ]
35+
:dedent:
36+
37+
To create a new role, define it in the :ref:`credentials.roles.* <configuration_reference_credentials_role>` section.
38+
In the example below, the 'writers_space_reader' role gets privileges to select data in the 'writers' space:
39+
40+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
41+
:language: yaml
42+
:start-after: spaces: [ books ]
43+
:end-at: spaces: [ writers ]
44+
:dedent:
45+
46+
Then, you can assign this role to a user using :ref:`credentials.users.\<username\>.roles <configuration_reference_credentials_users_name_roles>` ('sampleuser' in the example below):
47+
48+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
49+
:language: yaml
50+
:start-at: sampleuser:
51+
:end-at: [ writers_space_reader ]
52+
:dedent:
53+
54+
Apart from assigning a role to a user, you can grant specific privileges directly using :ref:`credentials.users.\<username\>.privileges <configuration_reference_credentials_users_name_privileges>`.
55+
In this example, 'sampleuser' get privileges to select and modify data in the 'books' space:
56+
57+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials/config.yaml
58+
:language: yaml
59+
:start-at: sampleuser:
60+
:end-at: [ books ]
61+
:dedent:
62+
63+
You can find the full example here: `credentials <https://github.com/tarantool/doc/tree/latest/doc/code_snippets/snippets/config/instances.enabled/credentials>`_.
64+
65+
66+
67+
.. _configuration_credentials_loading_secrets:
68+
69+
Loading secrets from safe storage
70+
---------------------------------
71+
72+
File:
73+
74+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials_context_file/config.yaml
75+
:language: yaml
76+
:start-at: config:
77+
:end-before: credentials:
78+
:dedent:
79+
80+
Env:
81+
82+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials_context_env/config.yaml
83+
:language: yaml
84+
:start-at: config:
85+
:end-before: credentials:
86+
:dedent:
87+
88+
Creds:
89+
90+
.. literalinclude:: /code_snippets/snippets/config/instances.enabled/credentials_context_env/config.yaml
91+
:language: yaml
92+
:start-at: credentials:
93+
:end-at: roles: [ replication ]
94+
:dedent:
95+
96+
You can find the full examples here: `credentials_context_file <https://github.com/tarantool/doc/tree/latest/doc/code_snippets/snippets/config/instances.enabled/credentials_context_file>`_, `credentials_context_env <https://github.com/tarantool/doc/tree/latest/doc/code_snippets/snippets/config/instances.enabled/credentials_context_env>`_.

0 commit comments

Comments
 (0)