User permissions enterprise

Weave GitOps Enterprise extends Weave GitOps permissions by adding more roles. These roles may need to be extended further in order to support certain use cases. Some of the most common use cases are described below.

Progressive delivery with Flagger

Weave GitOps Enterprise integrates with Flagger in order to provide a view on progressive delivery deployments. This includes the ability to view all the resources that Flagger manages during its operation. The default ClusterRole gitops-canaries-reader includes the minimum permissions necessary for a user to be able to view canary object details, metric template object details and canary related events.

When Flagger is configured to integrate with a service mesh such as Linkerd or Istio for the rollout, then this ClusterRole needs to be extended so that it can read the additional service mesh resources being generated by Flagger. Note that currently, in order to display service mesh or ingress related resources, we require spec.provider to be set in each canary resource.

The following table provides a list of all the custom resources that Flagger generates grouped by provider:

Provider	API Group	Resource
AppMesh	appmesh.k8s.aws	virtualnode
	appmesh.k8s.aws	virtualrouter
	appmesh.k8s.aws	virtualservice
Linkerd	split.smi-spec.io	trafficsplit
Istio	networking.istio.io	destinationrule
	networking.istio.io	virtualservice
Contour	projectcontour.io	httpproxy
Gloo	gateway.solo.io	routetable
	gloo.solo.io	upstream
Nginx	networking.k8s.io	ingress
Skipper	networking.k8s.io	ingress
Traefik	traefik.containo.us	traefikservice
Open Service Mesh	split.smi-spec.io	trafficsplit
Kuma	kuma.io	trafficroute
GatewayAPI	gateway.networking.k8s.io	httproute

For example, the following manifest shows how gitops-canaries-reader has been extended to allow the user for viewing TrafficSplit resources when Linkerd is used:

gitops-canaries-reader.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: gitops-canaries-reader
rules:
- apiGroups:
  - flagger.app
  resources:
  - canaries
  - metrictemplates
  verbs:
  - get
  - list
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - get
  - watch
  - list
# Additional permissions for Linkerd resources are added below
- apiGroups:
  - split.smi-spec.io
  resources:
  - trafficsplits
  verbs:
  - get
  - list

Setting up remote cluster permissions

In order to view canaries in a remote cluster from the management cluster, you need to consider the following:

• The service account used to access the remote cluster needs to be able to list namespaces and custom resource definitions in the given cluster. It additionally needs to be able to impersonate users and groups.
• The user or group that logs in to the management cluster, needs appropriate permissions to certain resources of the remote cluster.

For example, applying the following manifest on remote clusters, ensures that the wego-admin user will be able to view canary information from within the Weave GitOps Enterprise UI on the management cluster:

remote-cluster-service-user-rbac.yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: user-groups-impersonator
rules:
  - apiGroups: [""]
    resources: ["users", "groups"]
    verbs: ["impersonate"]
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get", "list"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: impersonate-user-groups
subjects:
  - kind: ServiceAccount
    name: remote-cluster-01  # Service account created in remote cluster
    namespace: default
roleRef:
  kind: ClusterRole
  name: user-groups-impersonator
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: canary-reader
rules:
  - apiGroups: [""]
    resources: [ "events", "services" ]
    verbs: [ "get", "list", "watch" ]
  - apiGroups: [ "apps" ]
    resources: [ "*" ]
    verbs: [ "get", "list" ]
  - apiGroups: [ "autoscaling" ]
    resources: [ "*" ]
    verbs: [ "get", "list" ]
  - apiGroups: [ "flagger.app" ]
    resources: [ "canaries", "metrictemplates"]
    verbs: [ "get", "list", "watch" ]
  - apiGroups: [ "helm.toolkit.fluxcd.io" ]
    resources: [ "helmreleases" ]
    verbs: [ "get", "list" ]
  - apiGroups: [ "kustomize.toolkit.fluxcd.io" ]
    resources: [ "kustomizations" ]
    verbs: [ "get", "list" ]
  - apiGroups: [ "source.toolkit.fluxcd.io" ]
    resources: [ "buckets", "helmcharts", "gitrepositories", "helmrepositories", "ocirepositories" ]
    verbs: [ "get", "list" ]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-canaries
subjects:
- kind: User
  name: wego-admin    # User logged in management cluster, impersonated via service account
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: canary-reader
  apiGroup: rbac.authorization.k8s.io

You may need to add more users/groups to the read-canaries ClusterRoleBinding to ensure additional users can view canary information from within the Weave GitOps Enterprise UI.