add: IRA Superadmin (#2212)

- Add SuperAdmin role as required e.g. by the cluster-agent
- Remove scope validation for non cluster-scoped IRAs
- Clear permissions denied if IRA feature is disabled

Author: iwilltry42

pkg/controller/permissions/permissions_check.go

@@ -123,6 +123,8 @@ func CheckPermissions(transport http.RoundTripper) router.HandlerFunc {
 			denied, _ := v1.GrantsAll(app.Namespace, copyWithName(details.Permissions, imageName), authzPerms)
 
 			app.Status.Staged.ImagePermissionsDenied = denied
+		} else {
+			app.Status.Staged.ImagePermissionsDenied = nil
 		}
 
 		// This is checking if the user granted all permissions that the app requires

pkg/install/install.go

@@ -744,7 +744,10 @@ func Roles() ([]kclient.Object, error) {
 	if err != nil {
 		return nil, err
 	}
-	for _, role := range append(roles.ClusterRoles(), roles.AWSRoles()...) {
+	r := roles.ClusterRoles()
+	r = append(r, roles.SuperAdminRole())
+	r = append(r, roles.AWSRoles()...)
+	for _, role := range r {
 		role := role
 		objs = append(objs, &role)
 	}

pkg/roles/roles.go

@@ -22,6 +22,9 @@ const (
 	GroupRoleAWSAcornIO = "role.aws.acorn.io"
 
 	AWSAdmin = "acorn:aws:admin"
+
+	// Cluster Agent Special
+	SuperAdmin = "acorn:super-admin"
 )
 
 var (
@@ -279,3 +282,20 @@ func AWSRoles() []rbacv1.ClusterRole {
 		},
 	}
 }
+
+func SuperAdminRole() rbacv1.ClusterRole {
+	return rbacv1.ClusterRole{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: SuperAdmin,
+		},
+		Rules: []rbacv1.PolicyRule{
+			{
+				APIGroups: []string{"*"},
+				Verbs:     []string{"get", "list", "watch", "update", "patch", "delete", "deletecollection", "create"},
+				Resources: []string{
+					"*",
+				},
+			},
+		},
+	}
+}

pkg/server/registry/apigroups/admin/imageroleauthorizations/validator.go

@@ -17,12 +17,6 @@ func (s *Validator) Validate(ctx context.Context, obj runtime.Object) (result fi
 		return append(result, field.Required(field.NewPath("imageSelector", "namePatterns"), "the image selector patterns must be defined to specify which images this rule applies to"))
 	}
 	result = append(result, validateSignatureRules(aiar.ImageSelector.Signatures)...)
-	for _, scope := range aiar.Roles.Scopes {
-		if scope == "cluster" {
-			result = append(result, field.Invalid(field.NewPath("roles", "scopes"), scope, "cannot authorize cluster-scoped in ImageRoleAuthorizations - use ClusterImageRoleAuthorizations instead"))
-		}
-		// TODO(@iwilltry42): do we want to validate possible values here?
-	}
 	return
 }