EVEREST-1502 | Remove admin policy from ConfigMap, hard-code it and load it internally

.github/workflows/dev-be-ci.yaml

@@ -358,7 +358,7 @@ jobs:
 
       - name: Add CI user to admin role
         run: |
-          kubectl patch configmap everest-rbac -n everest-system --patch "$(kubectl get configmap everest-rbac -n everest-system -o json | jq '.data["policy.csv"] += "\ng, everest_ci, admin:role"' | jq '{data: { "policy.csv": .data["policy.csv"] } }')"
+          kubectl patch configmap everest-rbac -n everest-system --patch "$(kubectl get configmap everest-rbac -n everest-system -o json | jq '.data["policy.csv"] += "\ng, everest_ci, role:admin"' | jq '{data: { "policy.csv": .data["policy.csv"] } }')"
           kubectl get configmap everest-rbac -n everest-system -ojsonpath='{.data.policy\.csv}'
 
       - name: Run integration tests

api-tests/generated/types.ts

@@ -40,11 +40,11 @@ export interface paths {
          *     *Example:*
          *     Assume the following RBAC policy, and users `alice` and `bob`:
          *     ```
-         *     p, admin:role, namespaces, read, *
-         *     p, admin:role, database-engines, *, *\/*
-         *     p, admin:role, database-clusters, *, *\/*
+         *     p, role:dev, namespaces, read, *
+         *     p, role:dev, database-engines, *, *\/*
+         *     p, role:dev, database-clusters, *, *\/*
          *     p, bob, database-clusters, *, *\/*
-         *     g, alice, admin:role
+         *     g, alice, role:dev
          *     ```
          *     The API will return the following permissions for `alice`:
          *     ```
@@ -844,7 +844,7 @@ export interface components {
         };
         NamespaceList: string[];
         UserPermissions: {
-            enabled?: boolean;
+            enabled: boolean;
             permissions?: string[][];
         };
         UserCredentials: {

commands/settings/rbac/can.go

@@ -39,8 +39,8 @@ $ everestctl settings rbac can alice read database-clusters my-namespace/cluster
 # Check if user 'alice' can perform all/any actions on 'cluster-1' in namespace 'my-namespace'
 $ everestctl settings rbac can alice '*' database-clusters my-namespace/cluster-1
 
-# Check if role 'admin:role' can update backup 'prod-backup-1' in namespace 'prod-namespace'
-$ everestctl settings rbac can admin:role update database-cluster-backups prod-namespace/prod-backup-1
+# Check if role 'role:admin' can update backup 'prod-backup-1' in namespace 'prod-namespace'
+$ everestctl settings rbac can role:admin update database-cluster-backups prod-namespace/prod-backup-1
 
 # Check if user 'bob' can delete all/any backups in namespace 'prod-namespace'
 $ everestctl settings rbac can bob delete database-cluster-backups prod-namespace/*

deploy/quickstart-k8s.yaml

@@ -92,15 +92,7 @@ metadata:
 data:
   enabled: "false"
   policy.csv: |
-    p, admin:role, namespaces, *, *
-    p, admin:role, database-engines, *, */*
-    p, admin:role, database-clusters, *, */*
-    p, admin:role, database-cluster-backups, *, */*
-    p, admin:role, database-cluster-restores, *, */*
-    p, admin:role, database-cluster-credentials, *, */*
-    p, admin:role, backup-storages, *, */*
-    p, admin:role, monitoring-instances, *, */*
-    g, admin, admin:role
+    g, admin, role:admin
 ---
 apiVersion: apps/v1
 kind: Deployment

docs/spec/openapi.yml

@@ -83,11 +83,11 @@ paths:
         *Example:*
         Assume the following RBAC policy, and users `alice` and `bob`:
         ```
-        p, admin:role, namespaces, read, *
-        p, admin:role, database-engines, *, */*
-        p, admin:role, database-clusters, *, */*
+        p, role:dev, namespaces, read, *
+        p, role:dev, database-engines, *, */*
+        p, role:dev, database-clusters, *, */*
         p, bob, database-clusters, *, */*
-        g, alice, admin:role
+        g, alice, role:dev
         ```
         The API will return the following permissions for `alice`:
         ```

pkg/common/constants.go

@@ -49,8 +49,12 @@ const (
 	// EverestJWTPublicKeyFile is the path to the JWT public key.
 	EverestJWTPublicKeyFile = "/etc/jwt/id_rsa.pub"
 
+	// EverestRBACRolePrefix is the prefix for roles.
+	EverestRBACRolePrefix = "role:"
 	// EverestAdminUser is the name of the admin user.
 	EverestAdminUser = "admin"
+	// EverestAdminRole is the name of the admin role.
+	EverestAdminRole = EverestRBACRolePrefix + "admin"
 
 	// EverestSettingsConfigMapName is the name of the Everest settings ConfigMap.
 	EverestSettingsConfigMapName = "everest-settings"

pkg/rbac/rbac.go

@@ -91,6 +91,10 @@ func refreshEnforcerInBackground(
 		if err := validatePolicy(enforcer); err != nil {
 			panic("invalid policy detected - " + err.Error())
 		}
+		// Calling LoadPolicy() re-writes the entire model, so we need to add back the admin role.
+		if err := loadAdminPolicy(enforcer); err != nil {
+			panic("failed to load admin policy - " + err.Error())
+		}
 		enforcer.EnableEnforce(IsEnabled(cm))
 	})
 	if inf.Start(ctx, &corev1.ConfigMap{}) != nil {
@@ -116,6 +120,9 @@ func newEnforcer(adapter persist.Adapter, enableLogs bool) (*casbin.Enforcer, er
 	if err != nil {
 		return nil, err
 	}
+	if err := loadAdminPolicy(enf); err != nil {
+		return nil, errors.Join(err, errors.New("failed to load admin policy"))
+	}
 	if err := validatePolicy(enf); err != nil {
 		return nil, err
 	}
@@ -178,6 +185,28 @@ func GetUser(c echo.Context) (string, error) {
 	return subject, nil
 }
 
+func loadAdminPolicy(enf casbin.IEnforcer) error {
+	paths, _, err := buildPathResourceMap("") // reads the swagger API definition
+	if err != nil {
+		return err
+	}
+	resources := make(map[string]struct{})
+	for _, resource := range paths {
+		resources[resource] = struct{}{}
+	}
+	action := "*"
+	for resource := range resources {
+		object := "*/*"
+		if resource == ResourceNamespaces {
+			object = "*"
+		}
+		if _, err := enf.AddPolicy(common.EverestAdminRole, resource, action, object); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
 // buildPathResourceMap builds a map of paths to resources and a list of resources.
 // Returns: (resourceMap, skipPaths, error) .
 func buildPathResourceMap(basePath string) (map[string]string, []string, error) {

pkg/rbac/testdata/policy-1-good.csv

@@ -1,29 +1,29 @@
-p, admin:role, namespaces, read, *
-p, admin:role, database-engines, *, */*
-p, admin:role, database-clusters, *, */*
-p, admin:role, database-cluster-backups, *, */*
-p, admin:role, database-cluster-restores, *, */*
-p, admin:role, backup-storages, *, */*
-p, admin:role, monitoring-instances, *, */*
+p, role:admin, namespaces, read, *
+p, role:admin, database-engines, *, */*
+p, role:admin, database-clusters, *, */*
+p, role:admin, database-cluster-backups, *, */*
+p, role:admin, database-cluster-restores, *, */*
+p, role:admin, backup-storages, *, */*
+p, role:admin, monitoring-instances, *, */*
 
-p, readonly:role, namespaces, read, *
-p, readonly:role, database-engines, read, */*
-p, readonly:role, database-clusters, read, */*
-p, readonly:role, database-cluster-backups, read, */*
-p, readonly:role, database-cluster-restores, read, */*
-p, readonly:role, backup-storages, read, */*
-p, readonly:role, monitoring-instances, read, */*
+p, role:readonly, namespaces, read, *
+p, role:readonly, database-engines, read, */*
+p, role:readonly, database-clusters, read, */*
+p, role:readonly, database-cluster-backups, read, */*
+p, role:readonly, database-cluster-restores, read, */*
+p, role:readonly, backup-storages, read, */*
+p, role:readonly, monitoring-instances, read, */*
 
-p, devteam:role, namespaces, *, *
-p, devteam:role, database-engines, *, dev/*
-p, devteam:role, database-clusters, *, dev/*
-p, devteam:role, database-cluster-backups, *, dev/*
-p, devteam:role, database-cluster-restores, *, dev/*
-p, devteam:role, backup-storages, *, */*
-p, devteam:role, monitoring-instances, *, */*
+p, role:devteam, namespaces, *, *
+p, role:devteam, database-engines, *, dev/*
+p, role:devteam, database-clusters, *, dev/*
+p, role:devteam, database-cluster-backups, *, dev/*
+p, role:devteam, database-cluster-restores, *, dev/*
+p, role:devteam, backup-storages, *, */*
+p, role:devteam, monitoring-instances, *, */*
 
 p, alice, database-clusters, create, alice/*
 
-g, admin, admin:role
-g, alice, readonly:role
-g, bob, devteam:role
+g, admin, role:admin
+g, alice, role:readonly
+g, bob, role:devteam

pkg/rbac/testdata/policy-2-bad.csv

@@ -1,4 +1,4 @@
-p, admin:role, namespaces, read, *
-p, admin:role, database-engines, *, */*
+p, role:admin, namespaces, read, *
+p, role:admin, database-engines, *, */*
 this is a bad policy
 xxxxxxxxxx

pkg/rbac/testdata/policy-3-bad.csv

@@ -1,6 +1,6 @@
-p, admin:role, namespaces, read, *
-p, admin:role, database-engines, *, */*
-p, admin:role, monitoring-instances, *, */*
-p, admin:role, monitoring instances, *, */*
-g, admin, admin:role
+p, role:admin, namespaces, read, *
+p, role:admin, database-engines, *, */*
+p, role:admin, monitoring-instances, *, */*
+p, role:admin, monitoring instances, *, */*
+g, admin, role:admin
 

pkg/rbac/testdata/policy-4-bad.csv

@@ -1,5 +1,5 @@
-p, admin:role, namespaces, read, *
-p, admin:role, database-engines, *, */*
-p, admin:role, monitoring-instances, *, */*
-p, notexists:role, monitoring-instances, *, */*
-g, admin, admin:role
+p, role:admin, namespaces, read, *
+p, role:admin, database-engines, *, */*
+p, role:admin, monitoring-instances, *, */*
+p, role:notexists, monitoring-instances, *, */*
+g, admin, role:admin

pkg/rbac/testdata/policy-5-bad.csv

@@ -1,4 +1,4 @@
-p, admin:role, namespaces, read, *
-p, admin:role, database-engines, *, */*
-p, admin:role, monitoring-instances, *, */*, asdfasdf
-g, admin, admin:role
+p, role:admin, namespaces, read, *
+p, role:admin, database-engines, *, */*
+p, role:admin, monitoring-instances, *, */*, asdfasdf
+g, admin, role:admin

pkg/rbac/testdata/policy-6-bad.csv

@@ -1,4 +1,4 @@
-p, admin:role, namespaces, read, *
-p, admin:role, database-engines, *, */*
+p, role:admin, namespaces, read, *
+p, role:admin, database-engines, *, */*
 p, alice, non-existent-resource, *, */*
-g, admin, admin:role
+g, admin, role:admin

pkg/rbac/testdata/policy-7-bad.csv

@@ -1,4 +1,4 @@
-p, admin:role, namespaces, read, *
-p, admin:role, database-engines, *, */*
-a, admin:role, database-clusters, *, */*
+p, role:admin, namespaces, read, *
+p, role:admin, database-engines, *, */*
+a, role:admin, database-clusters, *, */*
 

pkg/rbac/validate.go

@@ -11,6 +11,7 @@ import (
 	"github.com/casbin/casbin/v2"
 	"go.uber.org/zap"
 
+	"github.com/percona/everest/pkg/common"
 	"github.com/percona/everest/pkg/kubernetes"
 )
 
@@ -82,7 +83,11 @@ func checkResourceNames(policies [][]string) error {
 func checkRoles(roles []string, policies [][]string) error {
 	for _, policy := range policies {
 		roleName := policy[0]
-		if !strings.HasSuffix(roleName, ":role") {
+		if !strings.HasPrefix(roleName, common.EverestRBACRolePrefix) {
+			continue
+		}
+		if roleName == common.EverestAdminRole {
+			// Its fine to not assign the admin role to any user.
 			continue
 		}
 		if !slices.Contains(roles, roleName) {