Scope Down RBAC Permissions for Local Dev Service Accounts

[bobbravo2]

Overview

Priority: 🟡 MAJOR
Effort: 1-2 hours
Related PR: #246
Related Issue: #322, #323
Mentioned in: 3/6 code reviews

Replace wildcard RBAC permissions with scoped permissions for local development.

---

Problem

Current local dev RBAC grants excessive permissions:

# components/manifests/minikube/local-dev-rbac.yaml:110-118
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]  # ❌ Full cluster-admin

Issues:

1. backend-api has cluster-admin (unrestricted)
2. agentic-operator has cluster-admin (unrestricted)
3. Cannot test realistic RBAC boundaries
4. local-dev-user Role includes operations on cluster-scoped resources (namespaces)

---

Solution

1. Backend-API Scoped Permissions

Replace wildcard with specific needs:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: local-dev-backend-api
rules:
# CRD management
- apiGroups: ["vteam.ambient-code"]
  resources: ["agenticsessions", "projectsettings"]
  verbs: ["*"]
- apiGroups: ["vteam.ambient-code"]
  resources: ["agenticsessions/status", "projectsettings/status"]
  verbs: ["get", "update", "patch"]

# Namespace viewing (for project list)
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]

# Secret management (runner secrets)
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "update", "delete"]

# Job management (for runners)
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "create", "delete"]

# Pod management (for monitoring)
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]

# PVC management
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "create"]

# SubjectAccessReview for RBAC checks
- apiGroups: ["authorization.k8s.io"]
  resources: ["subjectaccessreviews", "selfsubjectaccessreviews"]
  verbs: ["create"]

2. Operator Scoped Permissions

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: local-dev-agentic-operator
rules:
# CRD watching and management
- apiGroups: ["vteam.ambient-code"]
  resources: ["agenticsessions", "projectsettings"]
  verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: ["vteam.ambient-code"]
  resources: ["agenticsessions/status", "projectsettings/status"]
  verbs: ["update", "patch"]

# Namespace watching
- apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list", "watch"]

# Job creation and management
- apiGroups: ["batch"]
  resources: ["jobs"]
  verbs: ["get", "list", "create", "update", "delete"]

# Pod monitoring
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

# Secret copying
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create", "update"]

# Service management
- apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list", "create", "delete"]

3. Fix local-dev-user Role

Remove cluster-scoped resources from namespace-scoped Role:

# Remove this - namespaces are cluster-scoped
# - apiGroups: [""]
#   resources: ["namespaces", ...]

# Keep only namespace-scoped resources
- apiGroups: [""]
  resources: ["pods", "services", "secrets", "configmaps"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

---

Testing Plan

Before Changes

kubectl auth can-i "*" "*" --as=system:serviceaccount:ambient-code:backend-api
# Result: yes (too broad)

After Changes

# Should have scoped access
kubectl auth can-i get agenticsessions --as=system:serviceaccount:ambient-code:backend-api
# Result: yes

kubectl auth can-i delete clusterroles --as=system:serviceaccount:ambient-code:backend-api
# Result: no (correct)

Verify Functionality

1. Run make local-up
2. Create agentic session
3. Verify backend operations work
4. Run ./tests/local-dev-test.sh

---

Dependencies

Must complete Issue #322 first - Token minting must work before we can properly test scoped permissions.

---

Acceptance Criteria

• backend-api ClusterRole uses scoped permissions (no wildcards)
• agentic-operator ClusterRole uses scoped permissions (no wildcards)
• local-dev-user Role only includes namespace-scoped resources
• All backend operations still work
• All operator operations still work
• RBAC tests pass
• Integration tests confirm scoped access

---

References

• components/manifests/minikube/local-dev-rbac.yaml:110-156
• components/manifests/base/rbac/backend-clusterrole.yaml (production example)
• components/manifests/base/rbac/operator-clusterrole.yaml (production example)
• PR feat: Local Dev with MiniKube #246 reviews (3/6 mentioned this)

---

Timeline: After Issue #322 completed

[Gkrumbach07]

Tracked in Jira: https://issues.redhat.com/browse/RHOAIENG-39092