fix PG coordinator context and RBAC subject (coder#8223)

spikecurtis · web-flow · commit 7943a5b85eb4 · 2023-06-27T10:14:31.000Z
Signed-off-by: Spike Curtis &lt;spike@coder.com&gt;
diff --git a/enterprise/coderd/coderd.go b/enterprise/coderd/coderd.go
@@ -417,7 +417,7 @@ func (api *API) updateEntitlements(ctx context.Context) error {
 		if enabled {
 			var haCoordinator agpltailnet.Coordinator
 			if api.AGPL.Experiments.Enabled(codersdk.ExperimentTailnetPGCoordinator) {
-				haCoordinator, err = tailnet.NewPGCoord(ctx, api.Logger, api.Pubsub, api.Database)
+				haCoordinator, err = tailnet.NewPGCoord(api.ctx, api.Logger, api.Pubsub, api.Database)
 			} else {
 				haCoordinator, err = tailnet.NewCoordinator(api.Logger, api.Pubsub)
 			}
diff --git a/enterprise/tailnet/pgcoord.go b/enterprise/tailnet/pgcoord.go
@@ -18,7 +18,9 @@ import (
 	"cdr.dev/slog"
 
 	"github.com/coder/coder/coderd/database"
+	"github.com/coder/coder/coderd/database/dbauthz"
 	"github.com/coder/coder/coderd/database/pubsub"
+	"github.com/coder/coder/coderd/rbac"
 	agpl "github.com/coder/coder/tailnet"
 )
 
@@ -82,7 +84,21 @@ type pgCoord struct {
 // NewPGCoord creates a high-availability coordinator that stores state in the PostgreSQL database and
 // receives notifications of updates via the pubsub.
 func NewPGCoord(ctx context.Context, logger slog.Logger, ps pubsub.Pubsub, store database.Store) (agpl.Coordinator, error) {
-	ctx, cancel := context.WithCancel(ctx)
+	ctx, cancel := context.WithCancel(dbauthz.As(ctx, rbac.Subject{
+		ID: uuid.Nil.String(),
+		Roles: rbac.Roles([]rbac.Role{
+			{
+				Name:        "tailnetcoordinator",
+				DisplayName: "Tailnet Coordinator",
+				Site: rbac.Permissions(map[string][]rbac.Action{
+					rbac.ResourceTailnetCoordinator.Type: {rbac.WildcardSymbol},
+				}),
+				Org:  map[string][]rbac.Permission{},
+				User: []rbac.Permission{},
+			},
+		}),
+		Scope: rbac.ScopeAll,
+	}.WithCachedASTValue()))
 	id := uuid.New()
 	logger = logger.Named("pgcoord").With(slog.F("coordinator_id", id))
 	bCh := make(chan binding)
@@ -103,6 +119,7 @@ func NewPGCoord(ctx context.Context, logger slog.Logger, ps pubsub.Pubsub, store
 		querier:        newQuerier(ctx, logger, ps, store, id, cCh, numQuerierWorkers, fHB),
 		closed:         make(chan struct{}),
 	}
+	logger.Info(ctx, "starting coordinator")
 	return c, nil
 }
 
@@ -171,6 +188,7 @@ func (c *pgCoord) ServeAgent(conn net.Conn, id uuid.UUID, name string) error {
 }
 
 func (c *pgCoord) Close() error {
+	c.logger.Info(c.ctx, "closing coordinator")
 	c.cancel()
 	c.closeOnce.Do(func() { close(c.closed) })
 	return nil

Original file line number	Diff line number	Diff line change
`@@ -417,7 +417,7 @@ func (api *API) updateEntitlements(ctx context.Context) error {`
`417`	`417`	`if enabled {`
`418`	`418`	`var haCoordinator agpltailnet.Coordinator`
`419`	`419`	`if api.AGPL.Experiments.Enabled(codersdk.ExperimentTailnetPGCoordinator) {`
`420`		`- haCoordinator, err = tailnet.NewPGCoord(ctx, api.Logger, api.Pubsub, api.Database)`
	`420`	`+ haCoordinator, err = tailnet.NewPGCoord(api.ctx, api.Logger, api.Pubsub, api.Database)`
`421`	`421`	`} else {`
`422`	`422`	`haCoordinator, err = tailnet.NewCoordinator(api.Logger, api.Pubsub)`
`423`	`423`	`}`