Deprecate legacy RBAC system #16014
Deprecate legacy RBAC system #16014
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR fully deprecates and removes the legacy RBAC system in favor of the ansible‐base RBAC implementation. Key changes include the removal of the batch role ancestor rebuilding functionality, the deletion of legacy database relationships and methods (like rebuild_role_ancestor_list and is_ancestor_of), and the cleanup of configuration, API, and migration logic to eliminate unused code paths.
Reviewed Changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| tools/data_generators/rbac_dummy_data_generator.py | Removed usage of the legacy batch_role_ancestor_rebuilding context manager. |
| awx/settings/defaults.py | Deleted the ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED setting and comments. |
| awx/main/signals.py | Removed signal handlers related to the legacy RBAC system. |
| awx/main/models/rbac.py | Removed legacy ancestor tracking fields, methods, and context managers. |
| awx/main/models/mixins.py | Updated imports to remove references to legacy RBAC fields. |
| awx/main/migrations/_rbac.py | Commented out legacy rebuild calls in migration code. |
| awx/main/management/commands/inventory_import.py | Eliminated legacy context manager usage from the inventory update flow. |
| awx/main/fields.py | Removed calls to rebuild legacy role ancestor lists after save/delete. |
| awx/main/access.py, awx/api/serializers.py, awx/api/generics.py | Updated permission and access queries to align with the new RBAC system. |
Comments suppressed due to low confidence (2)
awx/main/migrations/_rbac.py:251
- Since the legacy RBAC functionality is fully removed, consider removing the commented legacy code entirely to keep the migration file clean.
# Role.rebuild_role_ancestor_list(roots, []) # Removed - no longer needed with new RBAC system
awx/main/fields.py:355
- Verify that the removal of the rebuild_role_ancestor_list call during the post-save hook maintains the intended role parentage updates under the new RBAC system.
Role.rebuild_role_ancestor_list(role_ids, [])
Codecov ReportAttention: Patch coverage is
✅ All tests successful. No failed tests found. ❌ Your patch check has failed because the patch coverage (87.61%) is below the target coverage (100.00%). You can increase the patch coverage or adjust the target coverage. 🚀 New features to boost your workflow:
|
- Remove RoleAncestorEntry model and ancestors field from Role model - Remove rebuild_role_ancestor_list and batch_role_ancestor_rebuilding functions - Remove is_ancestor_of method and save method from Role model - Clean up role synchronization signals and mixins - Simplify RBAC models to use only ansible-base RBAC system This commit removes the core components of the legacy RBAC system that was conditionally activated via ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED setting. The codebase now exclusively uses the new ansible-base RBAC system.
- Remove ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED checks from API serializers - Simplify ResourceAccessList to use only new RBAC system - Remove conditional logic from access control classes - Clean up role permission handling in API generics - Remove legacy role ancestor and member management code This commit removes all conditional logic that would fall back to the old RBAC system, ensuring the API layer exclusively uses the new ansible-base RBAC system for all permission checks and role management.
- Remove ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATED setting from defaults - Clean up batch_role_ancestor_rebuilding import from models - Remove configuration that enabled conditional RBAC system usage This setting was used to conditionally enable the new ansible-base RBAC system while maintaining backward compatibility with the old system. Since the old system has been removed, this setting is no longer needed.
- Remove batch_role_ancestor_rebuilding usage from inventory import - Clean up ImplicitRoleField to remove ancestor rebuilding calls - Comment out rebuild_role_ancestor_list calls in migration helpers - Remove legacy RBAC context managers from data generators - Fix indentation and remove unused imports This commit cleans up utility functions, management commands, and migration helpers that were using the old RBAC system components. Migration files retain historical references but non-functional calls are commented out to prevent runtime errors.
- Clean up commented-out rebuild_role_ancestor_list calls in migration helpers - Replace with generic comments about legacy RBAC system removal - Ensure no traces of old RBAC function names remain in codebase This completes the cleanup of all references to the old RBAC system functions, ensuring a clean codebase with no remnants of the legacy implementation.
6ab697c to
78fd3ff
Compare
|
|
Checks actually look okay here. Baby YOLO 199 |
|
Discovered 2 new failures
that was coming from a method def check_read_access(tower_object, expected_forbidden=[], unprivileged=False):
"""Check GET against a Tower resource."""
# for test scenarios involving unprivileged users
if unprivileged:
with pytest.raises(awxkit.exceptions.Forbidden):
tower_object.get()
# for test scenarios involving privileged users
else:
tower_object.get()
for related in tower_object.related:
if related in expected_forbidden:
with pytest.raises(awxkit.exceptions.Forbidden):
tower_object.get_related(related)
else:
tower_object.get_related(related)So I can't say what the |
Summary
This PR removes the legacy RBAC system from AWX, completing the migration to the ansible-base RBAC system. The old RBAC system was conditionally activated via the
ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATEDsetting, but since the new system is now stable and fully functional, we can remove the old implementation entirely.Changes
Core RBAC System Removal
RoleAncestorEntrymodel and all related database relationshipsancestorsfield from theRolemodelrebuild_role_ancestor_list()andbatch_role_ancestor_rebuilding()functionsis_ancestor_of()method and customsave()method from Role modelAPI Layer Simplification
ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATEDconditional checks from API serializersResourceAccessListto use only the new RBAC systemawx/main/access.pyConfiguration Cleanup
ANSIBLE_BASE_ROLE_SYSTEM_ACTIVATEDsetting from defaultsUtility and Migration Code
batch_role_ancestor_rebuildingusage from inventory import commandsrebuild_role_ancestor_listcalls in migration helpersImpact
Testing
The existing test suite should continue to pass as this change only removes the unused legacy code path. The ansible-base RBAC system has been the active system and is thoroughly tested.
Migration Notes
Checklist