opened
ravisharda
username_0
**Problem description**

Some of the operations of the Controller gRPC interface require a higher permission level READ_UPDATE (read/write), even though they appear to be read operations that don't modify the state of the resource.  

Issue #3277 sought reducing permission for such "read" operations from `READ_UPDATE` to `READ`, among other things. PR [3492](https://github.com/pravega/pravega/pull/3492) reduced the permission levels for most of the read operations but left others out as described in that PR's description. This issue seeks to explore and fix permissions required for the remaining read operations, as well as any new read operations that might have been added since then. 

**Problem location**
`io.pravega.controller.server.rpc.grpc.v1.ControllerServiceImpl.java`. 

**Suggestions for an improvement**
Reducing permission required for Controller gRPC read operations 
issue
created
sarlaccpit
username_1
A couple examples of overly restrictive READ_UPDATE requirements may be:

https://github.com/pravega/pravega/blob/master/controller/src/main/java/io/pravega/controller/server/rpc/grpc/v1/ControllerServiceImpl.java#L184-L188

https://github.com/pravega/pravega/blob/master/controller/src/main/java/io/pravega/controller/server/rpc/grpc/v1/ControllerServiceImpl.java#L218-L224

I'm surveying these as part of an effort to really tailor down what it means to really have just read(only) access to a scope.   The conversation can extend also reader groups, water marking, stream cuts...
comment
closed
andreipaduroiu
username_2
issue