Roles¶

A blueprint of four roles. They may be combined or adapted, but the permissions listed in Secret Access are equivalent to reading Secrets and belong only to principals trusted with the Secrets of the namespace.

Role	Primary Goal	Scope	Cardinality
ARC Operator	Install and run ARC; restrict where the controller and workflows send credentials.	Cluster	Singleton
Artifact Type Provider	Define how artifacts are transferred: workflow templates and artifact types.	Cluster or Namespace	Many
Endpoint Provider	Provide the `Endpoint`s of a namespace and their credentials.	Namespace	Many
Artifact Transfer Requester	Request transfers between the `Endpoint`s of a namespace.	Namespace	Many

Permissions¶

Resource Type	Scope	Artifact Type Provider (cluster-wide)	Artifact Type Provider (namespaced)	Endpoint Provider	Artifact Transfer Requester
`ClusterArtifactType`	Cluster	CRUD	R	R	R
`ClusterWorkflowTemplate` (Argo)	Cluster	CRUD	R	-	-
`ArtifactType`	Namespace	CRUD (every namespace)	CRUD	R	R
`WorkflowTemplate` (Argo)	Namespace	CRUD (every namespace)	CRUD	-	-
`Secret`	Namespace	-	-	CRUD	-
`Endpoint`	Namespace	R (every namespace)	R	CRUD	R
`Order`	Namespace	-	-	-	CRUD
`ArtifactWorkflow`	Namespace	R (every namespace)	R	-	R
`Workflow`, `CronWorkflow` (Argo)	Namespace	R (every namespace)	R	-	R

The ARC Operator holds cluster-admin.

Manifests¶

Example bindings for the namespace team-a. A RoleBinding cannot grant cluster-scoped resources, so each namespaced role comes with a read-only ClusterRole for them. The Artifact Type Provider ClusterRole serves both scopes: bound with a ClusterRoleBinding it covers every namespace, bound with a RoleBinding only one.

Artifact Type Provider¶

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: arc-artifact-type-provider
rules:
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - artifacttypes
      - clusterartifacttypes
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtemplates
      - clusterworkflowtemplates
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - endpoints
      - artifactworkflows
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - argoproj.io
    resources:
      - workflows
      - cronworkflows
    verbs:
      - get
      - list
      - watch
---
# Namespace scope: ArtifactTypes and WorkflowTemplates in team-a only.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: arc-artifact-type-provider
  namespace: team-a
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: arc-artifact-type-provider
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: team-a:artifact-type-providers
---
# Namespace scope: read access to the ClusterArtifactTypes and
# ClusterWorkflowTemplates that ArtifactTypes in team-a may shadow or reference.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: arc-artifact-type-provider-cluster
rules:
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - clusterartifacttypes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - argoproj.io
    resources:
      - clusterworkflowtemplates
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: arc-artifact-type-provider-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: arc-artifact-type-provider-cluster
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: team-a:artifact-type-providers

Artifact Type Provider (cluster-wide)¶

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: arc-artifact-type-provider
rules:
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - artifacttypes
      - clusterartifacttypes
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - argoproj.io
    resources:
      - workflowtemplates
      - clusterworkflowtemplates
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - endpoints
      - artifactworkflows
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - argoproj.io
    resources:
      - workflows
      - cronworkflows
    verbs:
      - get
      - list
      - watch
---
# Grants the arc-artifact-type-provider ClusterRole in every namespace, which is
# equivalent to get on the Secrets of every namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: arc-artifact-type-provider
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: arc-artifact-type-provider
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: artifact-type-providers

Endpoint Provider¶

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: arc-endpoint-provider
rules:
  - apiGroups:
      - ""
    resources:
      - secrets
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - endpoints
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - artifacttypes
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: arc-endpoint-provider
  namespace: team-a
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: arc-endpoint-provider
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: team-a:endpoint-providers
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: arc-endpoint-provider-cluster
rules:
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - clusterartifacttypes
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: arc-endpoint-provider-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: arc-endpoint-provider-cluster
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: team-a:endpoint-providers

Artifact Transfer Requester¶

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: arc-artifact-transfer-requester
rules:
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - orders
    verbs:
      - create
      - delete
      - get
      - list
      - patch
      - update
      - watch
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - artifactworkflows
      - endpoints
      - artifacttypes
    verbs:
      - get
      - list
      - watch
  - apiGroups:
      - argoproj.io
    resources:
      - workflows
      - cronworkflows
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: arc-artifact-transfer-requester
  namespace: team-a
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: arc-artifact-transfer-requester
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: team-a:artifact-transfer-requesters
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: arc-artifact-transfer-requester-cluster
rules:
  - apiGroups:
      - arc.opendefense.cloud
    resources:
      - clusterartifacttypes
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: arc-artifact-transfer-requester-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: arc-artifact-transfer-requester-cluster
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: team-a:artifact-transfer-requesters