{"record":{"id":"c1ad89d6e20b4594","repo":"vitessio/vitess","slug":"rule-d-subjects-list-cannot-include-wildcard-and","errorCode":null,"errorMessage":"rule %d: subjects list cannot include wildcard and other subjects, have %v","messagePattern":"rule (.+?): subjects list cannot include wildcard and other subjects, have (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/vtadmin/rbac/config.go","lineNumber":101,"sourceCode":"\t}\n\n\t// reify the rules\n\tbyResource := map[string][]*Rule{}\n\trec := concurrency.AllErrorRecorder{}\n\n\tfor i, rule := range c.Rules {\n\t\tresourceRules := byResource[rule.Resource]\n\n\t\tactions := sets.New[string](rule.Actions...)\n\t\tif actions.Has(\"*\") && actions.Len() > 1 {\n\t\t\t// error to have wildcard and something else\n\t\t\trec.RecordError(fmt.Errorf(\"rule %d: actions list cannot include wildcard and other actions, have %v\", i, sets.List(actions)))\n\t\t}\n\n\t\tsubjects := sets.New[string](rule.Subjects...)\n\t\tif subjects.Has(\"*\") && subjects.Len() > 1 {\n\t\t\t// error to have wildcard and something else\n\t\t\trec.RecordError(fmt.Errorf(\"rule %d: subjects list cannot include wildcard and other subjects, have %v\", i, sets.List(subjects)))\n\t\t}\n\n\t\tclusters := sets.New[string](rule.Clusters...)\n\t\tif clusters.Has(\"*\") && clusters.Len() > 1 {\n\t\t\t// error to have wildcard and something else\n\t\t\trec.RecordError(fmt.Errorf(\"rule %d: clusters list cannot include wildcard and other clusters, have %v\", i, sets.List(clusters)))\n\t\t}\n\n\t\tresourceRules = append(resourceRules, &Rule{\n\t\t\tactions:  actions,\n\t\t\tsubjects: subjects,\n\t\t\tclusters: clusters,\n\t\t})\n\t\tbyResource[rule.Resource] = resourceRules\n\t}\n\n\tif rec.HasErrors() {\n\t\treturn rec.Error()","sourceCodeStart":83,"sourceCodeEnd":119,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/vtadmin/rbac/config.go#L83-L119","documentation":"During RBAC config reification, subjects (users/groups, with \"*\" as an all-subjects wildcard) are validated per rule. A rule cannot combine \"*\" with named subjects because it would be redundant and ambiguous. Reify records a validation error with the rule index and the full subject list so the config author can fix it before vtadmin starts serving.","triggerScenarios":"RBAC config rule containing `subjects: [\"*\", \"user@domain\"]` or any wildcard subject plus named users/groups, then loading the config via config.Reify at vtadmin startup.","commonSituations":"Admin adds a named user to an already-wildcard rule intending to tighten it; merging rule sets from different environments; automated config generation that unions wildcards with lists.","solutions":["Use \"*\" alone for a catch-all rule.","Or drop the wildcard and enumerate exactly the subjects allowed.","If a rule must apply to everyone plus a group for other purposes, split into separate rules."],"exampleFix":"// before\n{\"resource\": \"keyspaces\", \"actions\": [\"*\"], \"subjects\": [\"*\", \"admin@example.com\"]}\n// after\n{\"resource\": \"keyspaces\", \"actions\": [\"*\"], \"subjects\": [\"admin@example.com\"]}","handlingStrategy":"validation","validationCode":"for i, rule := range cfg.Rules {\n\tif slices.Contains(rule.Subjects, \"*\") && len(rule.Subjects) > 1 {\n\t\treturn fmt.Errorf(\"rule %d: subjects must be * alone or explicit list\", i)\n\t}\n}","typeGuard":"func subjectsValid(subjects []string) bool {\n\treturn !(slices.Contains(subjects, \"*\") && len(subjects) > 1)\n}","tryCatchPattern":"rules, err := cfg.Reify()\nif err != nil {\n\tlog.Fatalf(\"fix RBAC subjects config: %v\", err)\n}","preventionTips":["Use separate rules for wildcard access vs. named-subject access.","Avoid merging subject lists from different environments without deduplicating wildcards.","Add RBAC config tests covering wildcard-only and list-only rules."],"tags":["rbac","config-validation","vtadmin","authorization"],"backgroundTag":"wildcard-mixed-with-specific-subjects","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}