Roles¶

The roles serve as a blueprint for the intended usage scenario of Solar. These definitions are not rigid constraints; users can adapt, combine, or customize permissions in the boundaries set by Solar.

Description¶

Role	Primary Goal	Cardinality	Uses Solar API?
App Catalog Maintainer	Maintain applications catalog (OCM components).	Many	yes
K8s Cluster Provider	Ensure baseline compliance and tooling across a fleet of clusters.	Singleton	yes
K8s Cluster User	Deploy their specific business applications on their clusters.	Many	yes
Solar Operator	Ensure system health and maintain global config. (Solar)	Singleton	yes

Source Registry Operator	Ensure system health and maintain global config. (Source Registry)	Many	no
Deploy Registry Operator	Ensure system health and maintain global config. (Deploy Registry)	Many	no
App Provider	Provide deployable apps.	Many	no

Permissions¶

Resource Type	Namespace	App Catalog Maintainer	K8s Cluster Provider	K8s Cluster User
ComponentVersion	App Catalog Maintainer	CRUD	R	R
ComponentVersion	K8s Cluster Provider	-	CRUD	-
ComponentVersion	K8s Cluster User	-	-	CRUD
Target	App Catalog Maintainer	-	-	-
Target	K8s Cluster Provider	-	-	-
Target	K8s Cluster User	-	CRUD	RU
Release	App Catalog Maintainer	-	-	-
Release	K8s Cluster Provider	-	CRUD	-
Release	K8s Cluster User	-	-	CRUD
Profile	App Catalog Maintainer	-	-	-
Profile	K8s Cluster Provider	-	CRUD	-
Profile	K8s Cluster User	-	-	CRUD
ReleaseBinding	App Catalog Maintainer	-	-	-
ReleaseBinding	K8s Cluster Provider	-	CRUD	-
ReleaseBinding	K8s Cluster User	-	-	CRUD
Registry	App Catalog Maintainer	-	-	-
Registry	K8s Cluster Provider	-	CRUD	-
Registry	K8s Cluster User	-	-	CRUD
RegistryBinding	App Catalog Maintainer	-	-	-
RegistryBinding	K8s Cluster Provider	-	CRUD	-
RegistryBinding	K8s Cluster User	-	-	CRUD

Solar Operator: agent credentials¶

The Solar Operator sets up the solar-agent: one Release annotated solar.opendefense.cloud/target-credential: "true" per namespace that holds Targets. Setting that annotation, or changing the spec of such a Release, needs the verb inject-target-credential on releases. The solar chart ships the ClusterRole <fullname>-target-credential-injector with only that verb and binds it to nobody. Bind it to the Solar Operator in each of those namespaces (see Solar Operator below). No other role gets it: with it, a user can have a Target's token rendered into a chart they control.

Cross-Namespace Dependencies¶

Releases in the namespace of a K8s cluster provider or K8s cluster user can reference ComponentVersions in the namespace of an app catalog maintainer.
ReleaseBindings in the namespace of a K8s cluster provider can reference a Target in the namespace of a K8s cluster user.
RegistryBindings in the namespace of a K8s cluster provider can reference a Target in the namespace of a K8s cluster user.
Targets in the namespace of a K8s cluster user can reference a Registry in the namespace of a K8s cluster provider.
Profiles in the namespace of a K8s cluster provider must be able to match Targets in the namespace of a K8s cluster user.

The diagram shows an example of Solar resources and its dependencies. It doesn't cover all variations.

Manifests¶

Below are the ClusterRole, RoleBinding, and ReferenceGrant manifests that establish the permissions and cross-namespace requirements previously described. Note: k8s-cluster-provider.yaml needs to be applied before k8s-cluster-user.yaml.

App Catalog Maintainer¶

# CRUD permissions for Components, ComponentVersions, and ReferenceGrants
# in the App Catalog Maintainer's own namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: solar:app-catalog-maintainer
rules:
- apiGroups:
  - solar.opendefense.cloud
  resources:
  - componentversions
  - referencegrants
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
---
# Bind the ClusterRole to the App Catalog Maintainer's namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: solar:app-catalog-maintainer
  namespace: app-catalog-maintainer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: solar:app-catalog-maintainer
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: app-catalog-maintainer
---
# Allow Releases in the K8s Cluster Provider and K8s Cluster User namespaces to
# reference ComponentVersions in the App Catalog Maintainer's namespace.
apiVersion: solar.opendefense.cloud/v1alpha1
kind: ReferenceGrant
metadata:
  name: allow-release-cv-access
  namespace: app-catalog-maintainer
spec:
  from:
  - group: solar.opendefense.cloud
    kind: Release
    namespace: k8s-cluster-provider
  - group: solar.opendefense.cloud
    kind: Release
    namespace: k8s-cluster-user
  to:
  - group: solar.opendefense.cloud
    kind: ComponentVersion

K8s Cluster Provider¶

# CRUD permissions for all K8s Cluster Provider resources in their own namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: solar:k8s-cluster-provider
rules:
- apiGroups:
  - solar.opendefense.cloud
  resources:
  - componentversions
  - profiles
  - registries
  - registrybindings
  - releasebindings
  - releases
  - referencegrants
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
---
# Bind the ClusterRole to the K8s Cluster Provider's namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: solar:k8s-cluster-provider
  namespace: k8s-cluster-provider
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: solar:k8s-cluster-provider
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: k8s-cluster-provider
---
# Read access to Components and ComponentVersions in App Catalog Maintainer namespaces.
# Also used by the K8s Cluster User role (see k8s-cluster-user.yaml).
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: solar:acm-reader
rules:
- apiGroups:
  - solar.opendefense.cloud
  resources:
  - componentversions
  verbs:
  - get
  - list
  - watch
---
# Bind the read access to the App Catalog Maintainer's namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: solar:k8s-cluster-provider-acm-reader
  namespace: app-catalog-maintainer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: solar:acm-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: k8s-cluster-provider
---
# CRUD access to Targets in K8s Cluster User namespaces.
# The K8s Cluster Provider manages the Target lifecycle on behalf of cluster users.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: solar:k8s-cluster-provider-target-manager
rules:
- apiGroups:
  - solar.opendefense.cloud
  resources:
  - targets
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
---
# Bind the Target management access to the K8s Cluster User's namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: solar:k8s-cluster-provider-target-manager
  namespace: k8s-cluster-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: solar:k8s-cluster-provider-target-manager
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: k8s-cluster-provider
---
# Allow Targets in the K8s Cluster User namespace to reference Registries in this namespace.
apiVersion: solar.opendefense.cloud/v1alpha1
kind: ReferenceGrant
metadata:
  name: allow-target-registry-access
  namespace: k8s-cluster-provider
spec:
  from:
  - group: solar.opendefense.cloud
    kind: Target
    namespace: k8s-cluster-user
  # OCI tag cleanup runs as the RenderArtifact, which needs its own grant subject.
  - group: solar.opendefense.cloud
    kind: RenderArtifact
    namespace: k8s-cluster-user
  to:
  - group: solar.opendefense.cloud
    kind: Registry

K8s Cluster User¶

# CRUD permissions for all K8s Cluster User resources in their own namespace.
# Targets are read/update only — the K8s Cluster Provider manages their lifecycle.
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: solar:k8s-cluster-user
rules:
- apiGroups:
  - solar.opendefense.cloud
  resources:
  - componentversions
  - profiles
  - registries
  - registrybindings
  - releasebindings
  - releases
  - referencegrants
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - solar.opendefense.cloud
  resources:
  - targets
  verbs:
  - get
  - list
  - patch
  - update
  - watch
---
# Bind the ClusterRole to the K8s Cluster User's namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: solar:k8s-cluster-user
  namespace: k8s-cluster-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: solar:k8s-cluster-user
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: k8s-cluster-user
---
# Read access to Components and ComponentVersions in App Catalog Maintainer namespaces.
# Requires ClusterRole solar:acm-reader defined in k8s-cluster-provider.yaml.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: solar:k8s-cluster-user-acm-reader
  namespace: app-catalog-maintainer
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: solar:acm-reader
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: k8s-cluster-user
---
# Allow ReleaseBindings, RegistryBindings, and Profiles in the K8s Cluster Provider
# namespace to reference Targets in this namespace.
apiVersion: solar.opendefense.cloud/v1alpha1
kind: ReferenceGrant
metadata:
  name: allow-provider-target-access
  namespace: k8s-cluster-user
spec:
  from:
  - group: solar.opendefense.cloud
    kind: ReleaseBinding
    namespace: k8s-cluster-provider
  - group: solar.opendefense.cloud
    kind: RegistryBinding
    namespace: k8s-cluster-provider
  - group: solar.opendefense.cloud
    kind: Profile
    namespace: k8s-cluster-provider
  to:
  - group: solar.opendefense.cloud
    kind: Target

Solar Operator¶

# Let the Solar Operator opt the agent Release into receiving Target credentials.
# The ClusterRole ships with the solar chart (named for a Helm release "solar").
# Repeat the RoleBinding in every namespace that holds Targets.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: solar:target-credential-injector
  namespace: k8s-cluster-user
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: solar-target-credential-injector
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: solar-operator