Mirror the new RBAC UI role grants onto rbacsync's ClusterRole (EV-6977)

[dimitri-nicolo]

Description

Companion to calico-private#13388 (EV-6977). That PR cannot merge until this one does — draft until it has been reviewed alongside it.

calico-private adds resources to the managed calico-ui-* role catalogue to close gaps against what tigera-ui-user and tigera-network-admin already ship. Kubernetes' privilege-escalation guard only lets calico-kube-controllers create a ClusterRole granting permissions it already holds, so each of those grants has to be mirrored in rbacSyncControllerRules() — which is exactly what that function exists for, per its own doc comment.

The failure without this change is not partial. The rbacsync controller ensures cluster-context first and returns on error, so the gatewayapis grant alone would abort the whole sync cycle — tier roles and LMA roles included — with a forbidden error on every tick.

What's added

Grant	Verbs	Managed role that needs it
operator.tigera.io/gatewayapis	get	calico-ui-cluster-context
applicationlayer.projectcalico.org (6 WAF resources)	full CRUD	calico-ui-waf-{view,mod}
gateway.networking.k8s.io/gateways,httproutes	get,list,watch	calico-ui-waf-{view,mod}
apps/deployments	get,list,watch	calico-ui-waf-{view,mod}
policy.networking.k8s.io (3 resources)	full CRUD	calico-ui-admin-network-policies-{view,mod}
projectcalico.org/networks	full CRUD	calico-ui-egress-gateways-mod
projectcalico.org/securityeventwebhooks	full CRUD	calico-ui-webhooks-{view,mod}
crd.projectcalico.org/securityeventwebhooks	get,list,watch	calico-ui-webhooks-{view,mod}

Two of these deserve a second look:

• networks is already granted watch,list,get by the common rules, for the node controller's IPAM syncer. The egress-gateways modify role writes it, so the read-only grant does not clear the guard. It joins the existing projectcalico.org CRUD rule next to externalnetworks.
• The WAF and Gateway API rules already exist in KubeControllersEnterpriseCommonRules via wafRules() — but gated on gatewayAPIPresent. rbacsync needs them whenever RBAC management is enabled, independent of whether the GatewayAPI CR exists, so they are repeated in rbacSyncControllerRules() rather than leaning on that gate. Without that, the managed WAF roles would be creatable on Gateway API clusters and rejected by the escalation guard everywhere else. Open to instead widening the wafRules() gate to gatewayAPIPresent || rbacManagementEnabled if that reads better — it trades the duplication for a wider blast radius.

securityeventwebhooks moves out of the projectcalico.org-only list into its own rules now that it spans two API groups. The two groups are granted asymmetrically, mirroring the catalogue: the managed role writes through the aggregated projectcalico.org API, which validates the object, and only reads the CRD group behind it, so the escalation guard needs write on the former and reads on the latter. A test fails if the CRD group regains the write verbs.

Not needed, already held: configmaps (common rules), services including watch (base rules grant get,list,update,watch), and the three new lma.tigera.io resource names (the existing lma.tigera.io/cluster get rule is unscoped by resource name).

Testing

• A DescribeTable asserting each new grant is present on the rendered calico-kube-controllers ClusterRole when the gate is on, one entry per resource.
• A test that networks carries the modify verbs specifically, not just the IPAM syncer's reads.
• A negative test that policy.networking.k8s.io — granted by nothing else in the role — is absent when the feature is off.
• I confirmed the tests are not vacuous by reverting the gatewayapis and networks additions; both fail as intended.
• go test ./pkg/enterprise/... passes.

Affects Calico Enterprise only, and only when RBAC management is enabled.

Release Note

None

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

[dimitri-nicolo]

@electricjesus there's one decision here I'd like you to sign off on. The WAF grants from wafRules() are repeated in rbacSyncControllerRules() without the GatewayAPI gate, because rbacsync needs them whenever RBAC management is enabled. As a result, kube-controllers can patch any Deployment in the cluster while the feature is on. That is what lets it create the calico-ui-waf-mod role, which grants the same verb for the sidecar WAF toggle (see tigera/calico-private#13388). Let me know if that's too broad for this service account.