Retrieval of Reflective Information

[FelixMoelders]

Description

It would be nice to have a feature, to find out the name, read write access, i.e. reflective information on the workload that the python sdk is called from.

As requested by FelixMoelders/ankaios-dashboard#36 it is necessary to find out whether the calling sdk has write access.

Currently I retrieve the information with an anti-pattern:

def get_write_access(self):        
    write_access = {"writeAccess": True}

    try:
        workload = Workload.builder().workload_name("access_test").agent_name("access_test_agent").runtime("podman").runtime_config("").restart_policy("NEVER").build()
        self.ankaios.apply_workload(workload)
        self.ankaios.delete_workload("access_test")
    except AnkaiosException as e:
        print("Ankaios exception: ", e)
        if "Access denied" in str(e):
            write_access = {"writeAccess": False}
    
    return write_access

[windsource]

I think getting the name and available access rights are different topics.

Let's start with the name. Currently it is not available for the workload. A possible solution could be that Ankaios injects a certain environment variable in the workload (similar to Kubernetes) or mounting a special file like /etc/ankaios_workload. I prefer mounting a file as injecting environment variables has proven to create conflicts with others using that variable name already.

Regarding providing the access right to the workload: I am not sure if that should be implemented as this makes it easier for attackers to find possible attack vectors. But if you know the name of the workload and have at least read access, then you could read the state, check for your workload and read the access rights from there.