Secrets: Create more granular fixed roles for SecureValues (#108382)

pkg/registry/apis/secret/accesscontrol.go

@@ -29,6 +29,25 @@ var (
 
 func registerAccessControlRoles(service accesscontrol.Service) error {
 	// SecureValues
+	// These are broken down into more granular fixed roles on purpose.
+	// For inline Secure Values, we want to allow creation and deletion by Editors because there's no API to read/update.
+	// References are only available with the API and RBAC, so those roles can be granted to any basic role by Operators.
+	secureValuesCreator := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        "fixed:secret.securevalues:creator",
+			DisplayName: "Secure Values Creator",
+			Description: "Create secure values.",
+			Group:       "Secrets Manager",
+			Permissions: []accesscontrol.Permission{
+				{
+					Action: ActionSecretSecureValuesCreate,
+					Scope:  ScopeAllSecureValues,
+				},
+			},
+		},
+		Grants: []string{string(org.RoleEditor)},
+	}
+
 	secureValuesReader := accesscontrol.RoleRegistration{
 		Role: accesscontrol.RoleDTO{
 			Name:        "fixed:secret.securevalues:reader",
@@ -45,32 +64,36 @@ func registerAccessControlRoles(service accesscontrol.Service) error {
 		Grants: []string{string(org.RoleAdmin)},
 	}
 
-	secureValuesWriter := accesscontrol.RoleRegistration{
+	secureValuesUpdater := accesscontrol.RoleRegistration{
 		Role: accesscontrol.RoleDTO{
-			Name:        "fixed:secret.securevalues:writer",
-			DisplayName: "Secure Values Writer",
-			Description: "Create, update and delete secure values.",
+			Name:        "fixed:secret.securevalues:updater",
+			DisplayName: "Secure Values Updater",
+			Description: "Update secure values.",
 			Group:       "Secrets Manager",
 			Permissions: []accesscontrol.Permission{
-				{
-					Action: ActionSecretSecureValuesCreate,
-					Scope:  ScopeAllSecureValues,
-				},
-				{
-					Action: ActionSecretSecureValuesRead,
-					Scope:  ScopeAllSecureValues,
-				},
 				{
 					Action: ActionSecretSecureValuesWrite,
 					Scope:  ScopeAllSecureValues,
 				},
+			},
+		},
+		Grants: []string{string(org.RoleAdmin)},
+	}
+
+	secureValuesDeleter := accesscontrol.RoleRegistration{
+		Role: accesscontrol.RoleDTO{
+			Name:        "fixed:secret.securevalues:deleter",
+			DisplayName: "Secure Values Deleter",
+			Description: "Delete secure values.",
+			Group:       "Secrets Manager",
+			Permissions: []accesscontrol.Permission{
 				{
 					Action: ActionSecretSecureValuesDelete,
 					Scope:  ScopeAllSecureValues,
 				},
 			},
 		},
-		Grants: []string{string(org.RoleAdmin)},
+		Grants: []string{string(org.RoleEditor)},
 	}
 
 	// Keepers
@@ -119,7 +142,11 @@ func registerAccessControlRoles(service accesscontrol.Service) error {
 	}
 
 	return service.DeclareFixedRoles(
-		secureValuesReader, secureValuesWriter,
-		keepersReader, keepersWriter,
+		secureValuesCreator,
+		secureValuesReader,
+		secureValuesUpdater,
+		secureValuesDeleter,
+		keepersReader,
+		keepersWriter,
 	)
 }