Suggested Personas and Roles for Kuadrant

[didierofrivia]

About

All our good work in Kuadrant is based on the Gateway API, and this novel official Kubernetes specification, that represents the next generation of Kubernetes Ingress, was designed to be expressive, generic and role-oriented. This last bit is the key aspect of the specification, that discloses 3 specific Roles that will manage different resources in a specific way: An Infrastructure Provider, a Cluster operator and an Application Developer. The issue here is that currently our development is based only on a sole admin account, similar to the Infra Provider, instead of bearing in mind these different personas and thus once in a real case scenario when adjusted permissions are given to the users, we start encountering from bad UX to concerning security issues.

Proposition

Personas

Following the Gateway API example, we’ll model it in a simple 3 tier model mentioned above, which will also include assignment of the specific Kuadrant resources.

	Gateway Class	Gateway	Route	DNS Policy	TLS Policy	Auth Policy	RL Policy
Infra Provider	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Cluster Operators	No	Yes	Yes	Yes	Yes	Yes	Yes
App Developers	No	No	Yes*	No	No	Yes*	Yes*

* Could only be applied to specified namespaces.

Based on the proposed diagram, we could use the following examples of Cluster Roles:

Infrastructure Provider

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: infrastructure-provider
rules:
 - apiGroups: ["gateway.networking.k8s.io"]
   resources: ["*"]
   verbs: ["*"]
 - apiGroups: ["kuadrant.io"]
   resources: ["*"]
   verbs: ["*"]

Cluster Operators

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: cluster-operator
rules:
 - apiGroups: ["gateway.networking.k8s.io"]
   resources: ["gateways", "httproutes", "grpcroutes"]
   verbs: ["*"]
 - apiGroups: ["kuadrant.io"]
   resources: ["authpolicies", "ratelimitpolicies", "dnspolicies", "tlspolicies"]
   verbs: ["*"]

Application Developers

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
 name: app-developer
rules:
 - apiGroups: ["gateway.networking.k8s.io"]
   resources: ["httproutes", "grpcroutes"]
   verbs: ["*"]
 - apiGroups: ["kuadrant.io"]
   resources: ["authpolicies", "ratelimitpolicies"]
   verbs: ["*"]

TODO:

• Documentation
  We should recommend the use of this Roles/Personas in our docs, we are not going to enforce it, since it’s an area quite opinionated and varies drastically in every production cluster.

• Developing tools
  Regarding our daily development tools, our “make targets” should install the different dependencies (operators, CRDs, etc) with the different Personas contexts, thus it will replicate a more realistic use case.