11. Roles and Permissions for Konflux

Date: 2023-01-10

# Status

Accepted

Relates to 50. Exclude Kubernetes Events API from User RBAC Roles

# Context

Konflux is using Kubernetes as the control plane for managing its resources. We require a system for managing user roles and permissions in this context. We have defined the following roles for our project: “Contributor”, “Maintainer”, and “Admin”. We need to map these roles to specific permissions in the Kubernetes RBAC system, in terms of API groups, verbs, and resources.

# Decision

We will use the built-in Kubernetes RBAC system for Konflux’s role and permissions management, and map the following roles to specific permissions, as described in the table below:

# Roles

Viewer: Members who are mainly interested into CI results. Contributor: Members who interact with the workspace mostly through pull requests. Maintainer: Members who manage the workspace without access to sensitive or destructive actions. Admin: Members who have full access to the workspace including sensitive and destruction actions.

# Roles and Permissions Table

# Consequences

• This decision will allow us to easily integrate with the Kubernetes environment and take advantage of its robust and well-tested RBAC system.
• It will also allow us to assign the appropriate level of permissions to each role, based on the responsibilities and privileges associated with each role in our project.
• The use of the built-in Kubernetes RBAC system will improve the testability of our system, as we can use the well-documented and widely-used Kubernetes APIs for testing and validation.
• Using the built-in Kubernetes RBAC system may require some initial configuration and setup. However, it will likely require less ongoing maintenance and support compared to using a custom solution.