RBAC with OIDC groups

[sahil-sharma]

Hello,

I would like to configure separate groups configured in Keycloak and connect it via SSO RBAC with Argo-Workflows.
Each group should have different permissions, each group should see and run only the workflows that they are responsible for.
Is there any way to assign Role-based access to different OIDC groups to handle workflows execution?

There is already a similar discussion but have no sample example to properly follow or to understand.

Example:

I need to add all the namespaces here where workflows can be executed.

Groups in keycloak:

devops: contains users who should have admin access in argo-workflow
engineering: contains users who can create/list/get/execute Workflow or WorkflowTemplate in their namespace
data: contains users who can get/list/execute Workflow or WorkflowTemplate in their namespace

Now, I need to create specific Role ad RoleBindings attached to SA in every namespace. How can I do it via helm chart?

According to this, we have to create secrets manually bind to a SA.

I have this in my secrets.yaml. Which namespace should these secrets be created? In the argo-workflows installation namespace or respective service namespace? I am not clear here.

apiVersion: v1
kind: Secret
metadata:
  name: devops.service-account-token
  namespace: argo-workflows
  annotations:
    kubernetes.io/service-account.name: devops
type: kubernetes.io/service-account-token
---
apiVersion: v1
kind: Secret
metadata:
  name: engineering.service-account-token
  namespace: argo-workflows
  annotations:
    kubernetes.io/service-account.name: engineering
type: kubernetes.io/service-account-token
---
apiVersion: v1
kind: Secret
metadata:
  name: data.service-account-token
  namespace: argo-workflows
  annotations:
    kubernetes.io/service-account.name: data
type: kubernetes.io/service-account-token

I need to create SA accordingly but in argo-workflows namespace or service namespace? Please suggest.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: devops
  namespace: default
  annotations:
    workflows.argoproj.io/rbac-rule: "'devops' in groups"
    workflows.argoproj.io/rbac-rule-precedence: "1"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: engineering
  namespace: default
  annotations:
    workflows.argoproj.io/rbac-rule: "'engineering' in groups"
    workflows.argoproj.io/rbac-rule-precedence: "1"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: data
  namespace: default
  annotations:
    workflows.argoproj.io/rbac-rule: "'data' in groups"
    workflows.argoproj.io/rbac-rule-precedence: "1"

Now I updated my values.yaml file as:

workflow:
  rbac:
    create: true
    serviceAccounts:
      - name: devops
        namespace: default
      - name: engineering
        namespace: default
      - name: data
        namespace: default
    rules: []

Do I need to add extra rules like this so that above SA should create workflows or other resources:

rules:
  - apiGroups: ["argoproj.io"]
    resources: ["workflows", "workflowtemplates", "cronworkflows", "clusterworkflowtemplates"]
    verbs:  ["get", "list", "watch", "create", "update", "patch"]

As if I do not add then I get Permission Denied error in default namespace.

Let' say I want engineering/data groups should not have DELETE permissions on any resources. Then how can I assign it based on above rule.

Can someone share some insights or proper examples to have proper RBAC based on SA or groups via SSO?

Many thanks in advance!

[sahil-sharma]

@agilgur5 Sorry to tag you. Can you share some insights on this or redirect me to relevant person or place?