feat: register feedback with Milo IAM

README.md

@@ -46,6 +46,42 @@ config/milo/             Milo IAM ProtectedResources, Roles, discovery
 config/samples/          example resources
 ```
 
+## Access
+
+`config/milo` registers the service with Milo:
+
+- `iam/`: a `ProtectedResource` per kind (users act on their own `User`;
+  staff act platform-wide) and roles:
+
+  | Role | For |
+  | --- | --- |
+  | `feedback.miloapis.com-user` | every signed-in user, in their own user context |
+  | `feedback.miloapis.com-public-reader` | the website: visible posts, releases, changelog, acknowledgements |
+  | `feedback.miloapis.com-viewer` | staff read access, including hidden posts |
+  | `feedback.miloapis.com-reviewer` | the feedback queue: submissions, reviews, hiding posts |
+  | `feedback.miloapis.com-editor`, `-admin` | managing `FeedbackSource`s |
+  | `feedback.miloapis.com-security-team` | security reports; no other role can see them |
+
+- `rbac/`: Kubernetes RBAC in Milo for the service's own components, which
+  authenticate with client certificates:
+  `system:feedback-sync@feedback.miloapis.com`,
+  `system:feedback-controller@feedback.miloapis.com` and
+  `system:feedback-apiserver@feedback.miloapis.com`. Each is limited to its
+  own reads and writes; none needs `system:masters`.
+- `discovery/`: everything users touch appears in the platform and user
+  contexts; `FeedbackSource` only in the platform context.
+- `bindings/` (optional): the `feedback-security-team` group with the
+  security-team role, and the reviewer role for `staff-users`.
+
+Users get the user role by adding it to `inheritedRoles` of Milo's
+`iam-user-self-manage` role. That role is shared with other services, so
+the deployment patches it and keeps their entries.
+
+The apiserver enforces the contexts too: votes and subscriptions change
+only in their owner's context, submissions and security reports are created
+only by their author (or logged by the Security Team), and
+`FeedbackSource` is platform-only.
+
 ## Postgres
 
 The apiserver is the only component that connects to Postgres. Other
@@ -64,8 +100,10 @@ migrating at the same time. Add a migration as the next numbered file in
 ## Who writes what
 
 `feedback-sync` and `feedback-controller` are recognised by username
-(`--sync-users`, `--controller-users`; defaults are the `feedback-system`
-service accounts). On top of Milo's IAM:
+(`--sync-users`, `--controller-users`). The defaults are the common names of
+the client certificates they present to Milo:
+`system:feedback-sync@feedback.miloapis.com` and
+`system:feedback-controller@feedback.miloapis.com`. On top of Milo's IAM:
 
 - Only `feedback-sync` creates and deletes posts, and writes releases and
   changelog entries.
@@ -74,9 +112,11 @@ service accounts). On top of Milo's IAM:
   history, `highestNotified` and part-shipped records; the server computes
   vote counts. Fields a caller doesn't own are ignored, like spec on a
   status update. Anyone else gets Forbidden on post status.
-- Staff can change `spec.hidden` and metadata. Hidden posts are NotFound
-  outside the platform context and never listed on releases or changelog
-  entries.
+- Staff can change `spec.hidden` and metadata. Hidden posts are visible only
+  to callers allowed `get` on `posts/hidden` (staff, sync, the controller),
+  in any context; everyone else, the website included, gets NotFound. They
+  are never listed on releases or changelog entries or returned by
+  `PostQuery`.
 - `Release.status.posts` and `ChangelogEntry.status.posts` are derived from
   the posts table on every read.
 - Votes on a deleted post are kept for `--vote-retention` (30 days) in case

config/milo/bindings/kustomization.yaml

@@ -0,0 +1,26 @@
+# Who gets which role, platform-wide. Optional: a deployment includes this
+# component, or binds the roles to its own groups instead.
+#
+# - feedback-security-team gets the security-team role on reports.
+# - staff-users get the reviewer role on everything else. PolicyBindings
+#   select one kind each, so there is one file per kind.
+#
+# Users get feedback.miloapis.com-user on their own User by adding it to
+# inheritedRoles of Milo's iam-user-self-manage role. That role is shared
+# with other services, so the deployment patches it, keeping their entries.
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+  - security-team-group.yaml
+  - security-team-securityreports.yaml
+  - security-team-securityacknowledgements.yaml
+  - staff-reviewer-feedbacksources.yaml
+  - staff-reviewer-posts.yaml
+  - staff-reviewer-postqueries.yaml
+  - staff-reviewer-releases.yaml
+  - staff-reviewer-changelogentries.yaml
+  - staff-reviewer-votes.yaml
+  - staff-reviewer-subscriptions.yaml
+  - staff-reviewer-submissions.yaml
+  - staff-reviewer-securityacknowledgements.yaml

config/milo/bindings/security-team-group.yaml

@@ -0,0 +1,7 @@
+# Members are added with GroupMemberships. Keep it to the people who handle
+# vulnerability reports: membership grants every report's contents.
+apiVersion: iam.miloapis.com/v1alpha1
+kind: Group
+metadata:
+  name: feedback-security-team
+  namespace: milo-system

config/milo/bindings/security-team-securityacknowledgements.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-security-team-securityacknowledgements
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-security-team
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: feedback-security-team
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: SecurityAcknowledgement

config/milo/bindings/security-team-securityreports.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-security-team-securityreports
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-security-team
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: feedback-security-team
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: SecurityReport

config/milo/bindings/staff-reviewer-changelogentries.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-changelogentries
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: ChangelogEntry

config/milo/bindings/staff-reviewer-feedbacksources.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-feedbacksources
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: FeedbackSource

config/milo/bindings/staff-reviewer-postqueries.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-postqueries
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: PostQuery

config/milo/bindings/staff-reviewer-posts.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-posts
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: Post

config/milo/bindings/staff-reviewer-releases.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-releases
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: Release

config/milo/bindings/staff-reviewer-securityacknowledgements.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-securityacknowledgements
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: SecurityAcknowledgement

config/milo/bindings/staff-reviewer-submissions.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-submissions
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: Submission

config/milo/bindings/staff-reviewer-subscriptions.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-subscriptions
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: Subscription

config/milo/bindings/staff-reviewer-votes.yaml

@@ -0,0 +1,17 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: PolicyBinding
+metadata:
+  name: feedback-staff-reviewer-votes
+  namespace: milo-system
+spec:
+  roleRef:
+    name: feedback.miloapis.com-reviewer
+    namespace: milo-system
+  subjects:
+    - kind: Group
+      name: staff-users
+      namespace: milo-system
+  resourceSelector:
+    resourceKind:
+      apiGroup: feedback.miloapis.com
+      kind: Vote

config/milo/discovery/discovery-context-policy.yaml

@@ -4,8 +4,26 @@ metadata:
   name: feedback-service
 spec:
   rules:
-    # FeedbackSource is staff configuration. User-context resources (Vote,
-    # Submission, Subscription, ...) get their own rules as they are added.
+    # What a signed-in user works with in their own context: browsing and
+    # voting, following, and sending feedback and security reports.
     - group: feedback.miloapis.com
-      resources: ["feedbacksources"]
-      contexts: ["Platform"]
+      resources:
+        - posts
+        - postqueries
+        - releases
+        - changelogentries
+        - votes
+        - subscriptions
+        - attachmentuploads
+        - submissions
+        - securityreports
+        - securityacknowledgements
+      contexts:
+        - Platform
+        - User
+    # Staff configuration.
+    - group: feedback.miloapis.com
+      resources:
+        - feedbacksources
+      contexts:
+        - Platform

config/milo/iam/resources/attachmentuploads.yaml

@@ -0,0 +1,15 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: ProtectedResource
+metadata:
+  name: feedback.miloapis.com-attachmentuploads
+spec:
+  serviceRef:
+    name: "feedback.miloapis.com"
+  kind: AttachmentUpload
+  plural: attachmentuploads
+  singular: attachmentupload
+  permissions:
+    - create
+  parentResources:
+    - apiGroup: iam.miloapis.com
+      kind: User

config/milo/iam/resources/changelogentries.yaml

@@ -0,0 +1,26 @@
+apiVersion: iam.miloapis.com/v1alpha1
+kind: ProtectedResource
+metadata:
+  name: feedback.miloapis.com-changelogentries
+spec:
+  serviceRef:
+    name: "feedback.miloapis.com"
+  kind: ChangelogEntry
+  plural: changelogentries
+  singular: changelogentry
+  subresources:
+    - name: status
+      permissions:
+        - get
+        - update
+        - patch
+  permissions:
+    - get
+    - list
+    - create
+    - update
+    - patch
+    - delete
+  parentResources:
+    - apiGroup: iam.miloapis.com
+      kind: User

config/milo/iam/resources/feedbacksources.yaml

@@ -15,10 +15,10 @@ spec:
         - update
         - patch
   permissions:
-    - list
     - get
+    - list
     - create
     - update
-    - delete
     - patch
+    - delete
     - watch