Allow for the customization of user roles in Che provisioned namespaces

[cgruver]

Is your enhancement related to a problem? Please describe

The permissions granted to a user on their Che provisioned namespace are not permissive enough to allow the user to create some objects in their namespace that might be needed for their development work.

For example: create Kafka or KafkaTopic CRs, create port-forward to access ports on pods (Kubedock needs this), etc...

Describe the solution you'd like

Allow for a ClusterRole to be specified in the CheCluster CR that gets applied to the user in the provisioned namespace.

For example: admin, edit, or custom ClusterRole.

If not specified, then default to the current behavior.

Describe alternatives you've considered

No response

Additional context

No response

[tolusha]

No trivial, but it is possible even now:

1. Declare env var:

ECLIPSE_CHE_NAMESPACE=eclipse-che
OPERATOR_NAMESPACE=eclipse-che
CHE_CLUSTER_NAME=eclipse-che
CUSTOM_ROLES_NAME=che-custom-roles

2. Create needed roles:

kubectl apply -f - <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ${CUSTOM_ROLES_NAME}
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
rules:
  - verbs:
      - '*'
    apiGroups:
      - cert-manager.io
    resources:
      - certificates
EOF

3. Ensure operator can delegate needed roles:

kubectl apply -f - <<EOF
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ${CUSTOM_ROLES_NAME}
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
subjects:
  - kind: ServiceAccount
    name: che-operator
    namespace: ${OPERATOR_NAMESPACE}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ${CUSTOM_ROLES_NAME}
EOF

4. Patch CheCluster CR, to tell che-operator to add ClusterRoles to a che SA:

kubectl patch checluster/${CHE_CLUSTER_NAME} --patch '{"spec": {"components": {"cheServer": {"clusterRoles": ["che-custom-roles"]}}}}' --type=merge -n ${ECLIPSE_CHE_NAMESPACE}

5. Patch CheCluster CR, to tell che-server to add ClusterRoles to a user:

# ${ECLIPSE_CHE_NAMESPACE}-cheworkspaces-clusterrole and ${ECLIPSE_CHE_NAMESPACE}-cheworkspaces-devworkspace-clusterrole are defaults user's clusterrole
USER_CLUSTER_ROLES="${CUSTOM_ROLES_NAME},${ECLIPSE_CHE_NAMESPACE}-cheworkspaces-clusterrole,${ECLIPSE_CHE_NAMESPACE}-cheworkspaces-devworkspace-clusterrole"

kubectl patch checluster/eclipse-che --patch '{"spec": {"components": {"cheServer": {"extraProperties": {"CHE_INFRA_KUBERNETES_USER__CLUSTER__ROLES": "'${USER_CLUSTER_ROLES}'"}}}}}' --type=merge -n eclipse-che

[tolusha]

This PR [1] will avoid using step 4
[1] eclipse-che/che-operator#1663

[l0rd]

@tolusha does it make sense to add a specific field in the CheCluster CRD rather then using che-server extraProperties? Something like spec.devEnvironments.defaultNamespace.user.clusterRoles.

[tolusha]

@l0rd
I completely agree.
More over, we used to have such a filed in CheCluster API v1 [1].
Unfortunately it was dropped while without any reasons :(
Is it better to add the user field directly into devEnvironments section?

[1] https://github.com/eclipse-che/che-operator/blob/main/api/v1/checluster_types.go#L130

[l0rd]

Is it better to add the user field directly into devEnvironments section?

I was assuming that user clusterRoles are coupled to the defaultNamespace creation: the clusterRole is not created if the namespace autoProvision is set to false. But if I am wrong, if the clusterRole is created anyway, then yes user should be in devEnvironments.

[tolusha]

che-doc PR eclipse-che/che-docs#2590

1. Define the user roles name:

$ USER_ROLES=<name> 

2. Find out the namespace where the Che operator is deployed:

$ OPERATOR_NAMESPACE=$(kubectl get pods -l app.kubernetes.io/component=che-operator -o jsonpath={".items[0].metadata.namespace"} --all-namespaces)

3. Create needed roles:

$ kubectl apply -f - <<EOF
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ${USER_ROLES}
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
rules:
  - verbs:
      - <verbs> 
    apiGroups:
      - <apiGroups> 
    resources:
      - <resources> 
EOF

4. Delegate the roles to the Che operator:

$ kubectl apply -f - <<EOF
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ${USER_ROLES}
  labels:
    app.kubernetes.io/part-of: che.eclipse.org
subjects:
  - kind: ServiceAccount
    name: che-operator
    namespace: ${OPERATOR_NAMESPACE}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ${USER_ROLES}
EOF

5. Configure Che operator to delegate the roles to the che service account:

$ kubectl patch checluster eclipse-che \
  --patch '{"spec": {"components": {"cheServer": {"clusterRoles": ["'${USER_ROLES}'"]}}}}' \
  --type=merge -n eclipse-che

6. Configure che server to delegate the roles to a user:

$ kubectl patch checluster eclipse-che \
  --patch '{"spec": {"devEnvironments": {"user": {"clusterRoles": ["'${USER_ROLES}'"]}}}}' \
  --type=merge -n eclipse-che
SHELL

Wait until the rollout of Che server components finishes.
The user has to log out and log in to have the new roles applied.

[cgruver]

You guys rock!

Thanks for the quick turnaround. :-)