Extending pipeline promotions token security documentation

[enekofb]

Closes weaveworks/weave-gitops-enterprise#2564

What changed?

Extending existing guidance to include the ability to create deny semantics required for least privilege on access to the credentials token

Why was this change made?
Cause otherwise, pipeline controller would have access to the secret but nothing would have avoid that other roles has access to.

How was this change implemented?
Docs

How did you validate the change?

Tested locally

Release notes

Documentation Changes

[enekofb]

• policy or policy config https://docs.gitops.weave.works/docs/0.18.0/policy/policy-configuration/
• policy that should target clusterrole and role

[bigkevmcd]

Can we do a couple of things here?

1. Put the full version of this for users so that they can copy and paste.
2. Check what happens when someone uses * for verbs

[enekofb]

Given policy library is enterprise feature, I cannot add it here.

[enekofb]

@enekofb @squaremo

Assumptions / Actions:

Service Accounts

• none but pipeline-controller pod can user / impersonate pipeline-controller SA

Extend RBAC

• clusterrolebindings not allowed only admins
• rolebindings not allowed for non-pipeline namespace

Extend Policy

• restrict wildcards to secrets within my-pipeline-namespace
• restrict list to secrets within my-pipeline-namespace
• restrict as namespace owner I cannot create rolebinding nor clusterrolebindings to allow access anyone outside my ns
• only allow get secret to secret by name to pipeline-controller SA

[enekofb]

comments added from session with Michael and Kevin

[enekofb]

@MostafaMegahid how should we contribute these policies to the policy library ?

[enekofb]

Today we synced on this topic. the suggested path would be to

1. add these policies to policy library. An example of this could https://github.com/weaveworks/policy-library/tree/main/policies/RBACClusterRoleClusterAdmin
2. create a rbac best practices kustomization including the previous policies
3. reference this kustomization in the documentation

A user would only need to use this kustomization
cc @squaremo

[enekofb]

Draft PR for good practices within policy-library weaveworks/policy-library#31

[enekofb]

To review today with Mostafa

[squaremo]

Just edits as suggestions, this time. Once we have nailed down how to use the policy library, I think we're good to go.

[squaremo]

Thorough work Eneko, thank you so much for following this through. What a journey :-)