inspektor-dev / inspektor Goto Github PK

Microsoft teams are widely used by big enterprises and companies. So, it'll be a good addition for the users who are using teams to do temp credentials approval on teams itself

Inspektor doesn't have any tests which test the whole integration. So, add systest to do the end to end testing.

ssl will allow the end user to query and retrieve data in an encrypted way. So, add support for ssl in dataplane

Error message given by the postgres is not parsed correctly and forwarded to the client.

Instead of forwarding the correct error message, the inspektor just sends ERROR without any context.

We recently added support for creating temp credentials for users #23

But, the above PR alone doesn't solve the issue. We need a mechanism to drop connection if there is a side effect on session.

For example, a role removed by the admin or a session expired.

Describe the bug
Inspektor doesn't support json query support.

To Reproduce
Parse the following query

select * from tmpdb where cast(meta1->'refferedBy' as text) = '3332'

you'll get the following error

ParserError("Expected an expression:, found: >")

Expected behavior
Inspektor should be able to parse json query

clipboard api doesn't work without https or localhost

so provide a way to show secret token in insecure mode.

Systest was recently added to inspektor to do testing. But, systest doesn't run as part of github action workflow.

so add systest to github action so that we can continuously monitor the stability;

Table names are prefixed if any column is considered as protected column.

eg:

select * from actors -> select actor.ssn as NULL, actor.first_name from actors

This may retrieve the results. But it's breaking orm clients.

Expected Behaviour:

Table name should not be prefixed if not required.

explore ways how we can start measuring, time taken to evaluate a policy,
time it takes to rewrite a query..

Rust metrics crate seems interesting https://github.com/metrics-rs/metrics

all the credentials that Inspektor creates are long lived.

There should be a way where admins can create short lived credentials for data sources.

This can help teams to give temporary credentials to the user

control plane stores all of it's metadata in postgres backend.
Add other store backends like etcd as an optional storage backend.

Is your feature request related to a problem? Please describe.
if we not able to parse any of the query instead of failing, dataplane should be able to pass through the query

Describe the solution you'd like
This could solve the unsupported postgres operators. we can add the support by taking the control plane reports.

datasouce name has to be unique so that it won't collide with any polices.

Also, define the spec for datasource name

slack integration will ease to process of requesting temp credentials from admin.

for eg:

member can ask inspektor bot for credentials; the credentials will be provided on the approval of admin.

User are not able update the roles of the datasource once after created.

Right now, we don't know for what users are querying for. So, it'll be a good value addition if the admin can see what users are querying.

IDEA: dataplane should send all the logs to controlplane. Control plane pushes the logs to respective data sinks.

But, this put a lot of pressure on the control plane. We can make the dataplane to push the logs, but it'll be hard to configure.

Current postgres driver, only checks incoming query is valid or not. But, it doesn't know how to act in a transaction block.

for e.g.: end user can query user but can't insert as policy.

SELECT * FROM USERS;
BEGIN;
INSERT INTO USERS(first_name, last_name) VALUES ('pooni', 'kuttypoonai');
COMMIT;

The expected behaviour is that postgres should return data for select statements and send error for insert transaction. But, Inspektor
Postgres driver return error response directly.

we ended up in a situation, where developer entered wrong policies, then control plane couldn't be able to compile.

So, it'll be good if the dashboard shows whether a policy is in a healthy state or a bad state.

On a day-to day basis, orgs use multiple internal tools.

eg: metabase to visualise organisation data and retool to build internal apps

Team don't have any clear view on what these tools are doing and also whether these tools are being misused or not.

So come up with an idea, where inspektor can push some daily reports on slack. So, admins have some view on day-to-day data access. It'll be also used to capture if there's any anomaly on data access.

User able to switch to unauthorised db after gaining the access of authorised db.

Expected behaviour: inspektor should detect those scenario and restrict the user not to switch db.

MYSQL is a popular database in SQL world.

add support to enforce access policies on MYSQL server.

COPY query is not supported in the sqlparser.

add support for the copy command

Inspektor uses it's in-house authentication mechanism to access inspektor dashboard.

Add support for openID connect, so user can use their own identity provider to access inspektor

The admin can add roles while creating the user.

We need a way in a UI where we can change the role of the user.

Describe the bug
dataplane panics if the controlplane goes offline

To Reproduce
Bring down the controlplane

Expected behavior

dataplane should keep retry connecting controlplane

Now, all docker builds use the --no-cache flag to make sure a new binary is being sent to the docker image.

But, it's increasing the build time a lot.

On a local machine, it takes more than 5 mins to build the image. So, explore other opportunities, to decrease build time

reference: https://github.com/poonai/inspektor/blob/main/build_dataplane_docker.sh

Kafka is one of the popular message bus systems.

Add integration to enforce polices on kafka

Redshift is a aws data warehouse service.

One of the community member asked for this support 🥳

we have a policy with allowed attributes without column name. the expected behaviour for that policy is that, all the columns should be updateable.

But it's throwing unauthorized update error