Move fleetworkspace validation to GlobalRoleResolver

docs.md

@@ -135,7 +135,7 @@ Rules without verbs, resources, or apigroups are not permitted. The `rules` incl
 
  Escalation checks are bypassed if a user has the `escalate` verb on the GlobalRole that they are attempting to update or create. This can also be given through a wildcard permission (i.e. the `*` verb also gives `escalate`).
 
-Users can only change GlobalRoles with rights less than or equal to those they currently possess. This is to prevent privilege escalation. This includes the rules in the RoleTemplates referred to in `inheritedClusterRoles`.
+Users can only change GlobalRoles with rights less than or equal to those they currently possess. This is to prevent privilege escalation. This includes the rules in the RoleTemplates referred to in `inheritedClusterRoles` and the rules in `inheritedFleetWorkspacePermissions`.
 
 Users can only grant rules in the `NamespacedRules` field with rights less than or equal to those they currently possess. This works on a per namespace basis, meaning that the user must have the permission
 in the namespace specified. The `Rules` field apply to every namespace, which means a user can create `NamespacedRules` in any namespace that are equal to or less than the `Rules` they currently possess.

pkg/auth/globalrole.go

@@ -41,32 +41,7 @@ func (g *GlobalRoleResolver) GlobalRulesFromRole(gr *v3.GlobalRole) []rbacv1.Pol
 	return gr.Rules
 }
 
-// FleetWorkspaceRulesFromRole finds all rules which apply to all fleet workspaces except fleet-local.
-func (g *GlobalRoleResolver) FleetWorkspaceRulesFromRole(gr *v3.GlobalRole) []rbacv1.PolicyRule {
-	// no rules on a nil role
-	if gr == nil {
-		return nil
-	}
-	return gr.InheritedFleetWorkspacePermissions.ResourceRules
-}
-
-// FleetWorkspaceRulesFromRole finds all rules which apply to all fleet workspaces except fleet-local.
-func (g *GlobalRoleResolver) FleetWorkspaceVerbsRuleFromRole(gr *v3.GlobalRole, workspaceNames []string) []rbacv1.PolicyRule {
-	if gr == nil {
-		return nil
-	}
-
-	return []rbacv1.PolicyRule{
-		{
-			Verbs:         gr.InheritedFleetWorkspacePermissions.WorkspaceVerbs,
-			APIGroups:     []string{"management.cattle.io"},
-			Resources:     []string{"fleetworkspaces"},
-			ResourceNames: workspaceNames,
-		},
-	}
-}
-
-// ClusterRulesFromRole finds all rules which this gr gives on downstream clusters.
+// ClusterRulesFromRole finds all rules which this gr gives on downstream clusters and fleet workspaces except local.
 func (g *GlobalRoleResolver) ClusterRulesFromRole(gr *v3.GlobalRole) ([]rbacv1.PolicyRule, error) {
 	if gr == nil {
 		return nil, nil
@@ -90,6 +65,16 @@ func (g *GlobalRoleResolver) ClusterRulesFromRole(gr *v3.GlobalRole) ([]rbacv1.P
 		}
 		rules = append(rules, templateRules...)
 	}
+	if gr.InheritedFleetWorkspacePermissions.ResourceRules != nil {
+		rules = append(rules, gr.InheritedFleetWorkspacePermissions.ResourceRules...)
+	}
+	if gr.InheritedFleetWorkspacePermissions.WorkspaceVerbs != nil {
+		rules = append(rules, rbacv1.PolicyRule{
+			Verbs:     gr.InheritedFleetWorkspacePermissions.WorkspaceVerbs,
+			APIGroups: []string{"management.cattle.io"},
+			Resources: []string{"fleetworkspaces"},
+		})
+	}
 	return rules, nil
 }
 

pkg/codegen/main.go

@@ -45,7 +45,6 @@ func main() {
 					v3.Node{},
 					v3.Project{},
 					v3.ClusterProxyConfig{},
-					v3.FleetWorkspace{},
 				},
 			},
 			"provisioning.cattle.io": {

pkg/resources/management.cattle.io/v3/globalrole/GlobalRole.md

@@ -16,7 +16,7 @@ Rules without verbs, resources, or apigroups are not permitted. The `rules` incl
 
  Escalation checks are bypassed if a user has the `escalate` verb on the GlobalRole that they are attempting to update or create. This can also be given through a wildcard permission (i.e. the `*` verb also gives `escalate`).
 
-Users can only change GlobalRoles with rights less than or equal to those they currently possess. This is to prevent privilege escalation. This includes the rules in the RoleTemplates referred to in `inheritedClusterRoles`.
+Users can only change GlobalRoles with rights less than or equal to those they currently possess. This is to prevent privilege escalation. This includes the rules in the RoleTemplates referred to in `inheritedClusterRoles` and the rules in `inheritedFleetWorkspacePermissions`.
 
 Users can only grant rules in the `NamespacedRules` field with rights less than or equal to those they currently possess. This works on a per namespace basis, meaning that the user must have the permission
 in the namespace specified. The `Rules` field apply to every namespace, which means a user can create `NamespacedRules` in any namespace that are equal to or less than the `Rules` they currently possess.