Receptor Access Control

[fosterseth]

Adds work submission authority verification to receptor

• Control "role" can submit work on execution nodes or other control nodes
• Execution "role" cannot submit work anywhere

Need the firewall feature to prevent execution nodes from connecting to control nodes' control service, in addition to the sign work request feature

Acceptance criteria:

• Log in to execution node and attempt to submit work on another node on the mesh -- Work should fail / be revoked
• Log in to control node and attempt to submit work to another control node, or an execution node -- Work should succeed
• Log in to control node whose signed token has expired and attempt to submit work anywhere -- Work should fail / be revoked

Time estimate: 1 Sprint

see https://hackmd.io/@shanemcd/SJPn85FJt

[yagomarques]

we've already tested this functionality on the PR and Testathon, it's working in basic topologies. Maybe we would like to test in more complex topologies.

@Zokormazo @thenets @CFSNM @jneedle

[jneedle]

@Zokormazo and @thenets tagging both of you to track this to closure. If we are confident with our current coverage, feel free to close.

[thenets]

@jneedle I think we don't have coverage for this on the AWX side yet. I couldn't find it, at least. After the fixtures we made two weeks ago, I believe that will not be too hard or consuming automate this test.

[Zokormazo]

we have some level of coverage. Will open follow up item to track the rest.