Keystore RBAC Configuration Issues

SUMMARY

Changes to the RBAC to incorporate the keystore items has created various issues with the config that cannot be corrected aside from assigning users "admin" roles. First, actions/workflows that are grant permission to a user by RBAC role config to DO NOT apply to keystore operations that are executed within it. This includes any internal client functions coded in an action or any tasks that call keystore actions within the workflow. Second, there is no way to configure RBAC to work around this limitation as none of the keystore operations are available to be configured in the global RBAC context and can only be applied to individual keys that are known by name which does not allow for the creation of any new system-level keys (as the name/resource ID is not known until the action is run). As a result, you cannot even work around the issue by creating a config that would allow a user to have "Admin" access to keystore items, but limit their ability to execute actions within the system.

Ideally, RBAC would be updated to allow ALL of the keystore operations

https://github.com/StackStorm/st2/blob/606f42f41ca4fd2ed69da43d6ea124a76ad826a2/st2common/st2common/rbac/types.py#L369

to be defined globally.

https://github.com/StackStorm/st2/blob/606f42f41ca4fd2ed69da43d6ea124a76ad826a2/st2common/st2common/rbac/types.py#L437

Along with the global config options, the RBAC config should incorporate the ability to define keystore resource IDs using a regex filter so it could allow for very granular access to specific (or groups of specific items) in the keystore for each different operation on a per user/role basis.

STACKSTORM VERSION

3.7 and greater with RBAC enabled

OS, environment, install method

Centos 8/Rocky Linux

Steps to reproduce the problem

Create an RBAC config that allows a user to perform an action that includes the reading or writing of any keystore item and run the workflow as that user.

Expected Results

Action permission should allow the workflow to be executed.

Actual Results

Workflow fails at task/action that attempts to perform the keystore action.

Start with st2common/st2common/rbac/types.py at the referenced lines around 369 and 437, then reproduce the RBAC workflow that reads or writes a keystore item. Trace how permissions are evaluated for workflow tasks and keystore operations. Done means the reported workflow succeeds without admin access and RBAC can express the required global and resource-scoped keystore permissions.