How can we configure read-only access for specific users in Chef Infra Server, ensuring they can view resources without the ability to modify them?

how to configure fine-grained access control in Chef Infra Server ?

All commands assume a properly configured knife setup for an admin user within the Chef organization.

This article is about using custom groups, assigning users, and managing permissions using the knife acl plugin. 

 

The knife-acl plugin is used to manage Access Control Lists (ACLs) on Chef Infra Server, enabling administrators to define and control permissions for users, groups, and containers.

 

Key Features of knife-acl

• Modify ACLs for objects like cookbooks, nodes, roles, and environments.
• Grant or revoke permissions for users and groups.
• Manage access to containers (e.g., cookbooks, nodes, clients).

 

Chef Server Roles-Based Access Control (RBAC) Summary:

Chef Server uses Role-Based Access Control (RBAC) to manage permissions for users and groups. In this context, a container refers to an API endpoint associated with a specific object type (e.g., nodes, cookbooks, roles). Controlling access to these containers using ACLs allows administrators to define what actions users or groups can perform on various Chef objects.

 

For example, the container for creating client objects is called clients, and the container for creating node objects is called nodes. Each container corresponds to a specific object type in the Chef Server API and is used to manage access permissions for that type.

• clients
• cookbooks & cookbook_artifacts
• data
• environments
• groups
• nodes
• policies
• policy_groups
• roles
• sandboxes

Default permissions for containers  - Default Permissions for Containers

 

 

Configure fine-grained access control in Chef Infra Server - Selectively Allow Access

To grant selective access, you can create a new group and manage its members using the knife-acl plugin. Then, assign this group to the Access Control Entries (ACEs) of the relevant containers and/or objects based on your specific access requirements. The details about the process is as below.

 

Changing permissions on a container only affects new objects. Existing objects will keep their current permissions unless updated individually.

 

1. Create a custom group for limited-access users.
   

   knife group create GROUP_NAME
   example - knife group create custom-access

2. Add users to the custom group.

   knife group add MEMBER_TYPE MEMBER_NAME GROUP_NAME
   example - knife group add user user1 custom-access
   example - knife group add user user2 custom-access

3. Selectively assign Access - This below example is for providing access for just reading cookbooks and and propagate permissions to existing objects.

   knife acl add group custom-access containers sandboxes read
   knife acl add group custom-access containers cookbooks read
   knife acl bulk add group custom-access cookbooks '.*' read

4. Reading of Nodes and propagate permissions to existing objects.

   knife acl add group custom-access containers nodes read
   knife acl bulk add group custom-access nodes '.*' read

5. Reading of Roles and propagate permissions to existing objects.

   knife acl add group custom-access containers roles read
   knife acl bulk add group custom-access roles '.*' read

6. Remove Users from the Default users Group

   Users group

   The "Users" group by default provides regular (non-admin) users a lot of access to modify objects in the Chef Server.(https://docs.chef.io/server/server_orgs/#groups)

   Removing the "Users" group from the "create", "update", "delete" and "grant" Access Control Entries (ACEs) of all objects and containers will create a default read-only access for non-admin users.

   In order to have selective access, the user needs to be removed from the Users group. List the groups and edit the groups/users.json and remove the required Users who are part of the selective group.

   knife list groups
   EDITOR=vi knife edit groups/users.json 

7. Verify ACL Settings - Use knife acl show to confirm that permissions are correctly applied to both containers and individual objects.
8. Test Access - Log in as a user in the custom group to verify they have the intended access.

This configuration ensures users have secure, custom access while maintaining control over Chef objects.

 

 

Permissions Management Best Practice

The recommended approach for managing permissions is to add only clients or groups to an object's permissions. While it is technically possible to grant access to individual users, it's best to do so by adding the user to a group and then assigning that group to the object’s permissions. This method is significantly easier to maintain and scale compared to managing permissions for individual users across multiple objects.

To enforce this practice, the knife acl add and knife acl bulk add commands are restricted to only allow adding clients or groups to an object’s permissions—not individual users.

If a group ever needs to be removed from all objects' permissions, you can simply delete the group, effectively revoking access without needing to manually update each object.

 

 

Important Notes

• The "Users" group is special and should not be managed using knife-acl.
• ACL changes may require a Chef Infra Server restart to take effect.
• Some versions of Chef Infra Server have known issues with ACL modifications

 

References - 

knife acl - https://github.com/chef-boneyard/knife-acl