Issue restricting Workspace access in Fleet UI in Rancher using RBACs

[jamescooke-xyz]

Is there an existing issue for this?

• [X] I have searched the existing issues

Current Behavior

We have a user who should only have access to one workspace in Fleet. We have configured all RBACs as documented here: https://fleet.rancher.io/multi-user

This works well with one exception. On the Continuous Delivery tab, the user does not have access to see any workspaces in the dropdown. See image:

To allow for this combo-box to be populated, we appear to need to grant Cluster-wide access for this user to list workspaces:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-fleet-list-workspaces
rules:
  - apiGroups:
      - management.cattle.io
    resources:
      - fleetworkspaces
    verbs:
      - list

However, when doing this, the user gets to see all workspaces in this combo-box (and on the workspaces page). They still only see the relevant GitRepo/Bundle/etc resources, but we do not want them seeing the names of the other workspaces that they do not have access to.

Expected Behavior

The user should only see the workspaces they have access to in this combo-box.

Steps To Reproduce

1. Create a user who does not have access to the Continuous Delivery screens in the Fleet UI in Rancher
2. Create more than one workspace
3. Create RBACs to restrict access to all of the resources within each workspace, ensuring the test user only has access to one of the two workspaces
4. Access the Continuous Delivery screens in the Fleet UI in Rancher

The user will not see any of the workspaces listed in the combo-box, so will not be able to select their desired workspace to view their resources. Alternately, if you then give Cluster-wide access to list all workspaces, the user will see the names of all workspaces - which is also not desirable.

Environment

- Architecture: amd64
- Fleet Version: 0.7.1
- Cluster:
  - Provider: EKS
  - Options: tested on 1 and 3 nodes
  - Kubernetes Version: v1.24.17

Logs

No response

Anything else?

No response

[raulcabello]

You can use resourceNames to solve this problem. For example, just workspaceA and workspaceB would be displyaed with following ClusterRole :

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-fleet-list-workspaces
rules:
  - apiGroups:
      - management.cattle.io
    resources:
      - fleetworkspaces
    verbs:
      - list
    resourcesNames:
      - workspaceA
      - workspaceB

Alternatively, you can use GlobalRole and namespacedRules to restrict access to specific workspaces. This would make easier to bind this permissions to new users or groups within Rancher. We will add this to the fleet docs, see this PR for more info.