{"record":{"id":"3df063964fa7e231","repo":"vitessio/vitess","slug":"rule-d-actions-list-cannot-include-wildcard-and","errorCode":null,"errorMessage":"rule %d: actions list cannot include wildcard and other actions, have %v","messagePattern":"rule (.+?): actions list cannot include wildcard and other actions, have (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/vtadmin/rbac/config.go","lineNumber":95,"sourceCode":"// must be reified before first use. Calling Reify multiple times has no effect\n// after the first call. Reify is called by LoadConfig, so a config loaded that\n// way does not need to be manually reified.\nfunc (c *Config) Reify() error {\n\tif c.reified {\n\t\treturn nil\n\t}\n\n\t// reify the rules\n\tbyResource := map[string][]*Rule{}\n\trec := concurrency.AllErrorRecorder{}\n\n\tfor i, rule := range c.Rules {\n\t\tresourceRules := byResource[rule.Resource]\n\n\t\tactions := sets.New[string](rule.Actions...)\n\t\tif actions.Has(\"*\") && actions.Len() > 1 {\n\t\t\t// error to have wildcard and something else\n\t\t\trec.RecordError(fmt.Errorf(\"rule %d: actions list cannot include wildcard and other actions, have %v\", i, sets.List(actions)))\n\t\t}\n\n\t\tsubjects := sets.New[string](rule.Subjects...)\n\t\tif subjects.Has(\"*\") && subjects.Len() > 1 {\n\t\t\t// error to have wildcard and something else\n\t\t\trec.RecordError(fmt.Errorf(\"rule %d: subjects list cannot include wildcard and other subjects, have %v\", i, sets.List(subjects)))\n\t\t}\n\n\t\tclusters := sets.New[string](rule.Clusters...)\n\t\tif clusters.Has(\"*\") && clusters.Len() > 1 {\n\t\t\t// error to have wildcard and something else\n\t\t\trec.RecordError(fmt.Errorf(\"rule %d: clusters list cannot include wildcard and other clusters, have %v\", i, sets.List(clusters)))\n\t\t}\n\n\t\tresourceRules = append(resourceRules, &Rule{\n\t\t\tactions:  actions,\n\t\t\tsubjects: subjects,\n\t\t\tclusters: clusters,","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/vtadmin/rbac/config.go#L77-L113","documentation":"When reifying the RBAC config, each rule's actions are validated: a rule may either use the wildcard \"*\" (meaning all actions) or a list of specific actions, but not both. Mixing \"*\" with concrete actions is ambiguous, so Reify records a validation error identifying the rule by index. This runs before any request matching, preventing ambiguous authorization semantics.","triggerScenarios":"An RBAC config file rule with `actions: [\"*\", \"GetSchema\"]` or any wildcard plus other action names, then calling rbac config.Reify (done at vtadmin startup).","commonSituations":"Hand-edited RBAC JSON/YAML where a user added a specific action 'just to be safe' alongside *; template-generated configs appending actions to a wildcard default; copy-paste between rules.","solutions":["Remove the wildcard and list only the needed actions.","Or keep \"*\" alone and drop the other actions if all actions are intended.","Validate the rule index reported in the error against your config file to locate the offending rule."],"exampleFix":"// before\n{\"resource\": \"tablets\", \"actions\": [\"*\", \"GetTablet\"]}\n// after\n{\"resource\": \"tablets\", \"actions\": [\"*\"]}\n// or\n{\"resource\": \"tablets\", \"actions\": [\"GetTablet\", \"GetTablets\"]}","handlingStrategy":"validation","validationCode":"for i, rule := range cfg.Rules {\n\thasWildcard := slices.Contains(rule.Actions, \"*\")\n\tif hasWildcard && len(rule.Actions) > 1 {\n\t\treturn fmt.Errorf(\"rule %d: actions must be * alone or explicit list\", i)\n\t}\n}","typeGuard":"func actionsValid(actions []string) bool {\n\treturn !(slices.Contains(actions, \"*\") && len(actions) > 1)\n}","tryCatchPattern":"rules, err := cfg.Reify()\nif err != nil {\n\tvar verr *validationError\n\tif errors.As(err, &verr) {\n\t\tlog.Fatalf(\"invalid RBAC config: %v\", verr)\n\t}\n}","preventionTips":["Lint RBAC configs in CI with the same wildcard checks Reify performs.","Treat \"*\" as exclusive in your config templates.","Schema-validate the RBAC config with a JSON schema disallowing wildcard-plus-list."],"tags":["rbac","config-validation","vtadmin","authorization"],"backgroundTag":"wildcard-mixed-with-specific-actions","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}