Set ClusterRole for roleRef in unauth webook example

[dustymabe]

Otherwise my webhooks don't work and I get failure replies to my sent webhooks with messages like:

RBAC: role.rbac.authorization.k8s.io \"system:webhook\" not found.

[dustymabe]

cc @adambkaplan

[ocpdocs-previewbot]

🤖 Thu Jul 10 21:50:12 - Prow CI generated the docs preview:

https://95980--ocpdocs-pr.netlify.app/openshift-dedicated/latest/cicd/builds/triggering-builds-build-hooks.html
https://95980--ocpdocs-pr.netlify.app/openshift-enterprise/latest/cicd/builds/triggering-builds-build-hooks.html
https://95980--ocpdocs-pr.netlify.app/openshift-rosa-hcp/latest/cicd/builds/triggering-builds-build-hooks.html
https://95980--ocpdocs-pr.netlify.app/openshift-rosa/latest/cicd/builds/triggering-builds-build-hooks.html

[openshift-ci]

@dustymabe: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[adambkaplan]

/hold

We were deliberate in using Role instead of ClusterRole in the docs here.

OpenShift's mechanism for triggering builds generically via webhooks is dated and doesn't incorporate OWASP best practices - particularly protections around access control, as evidenced by the current docs. Granting the system:webhook role to the system:unauthenticated group globally means that anyone can trigger a resource-intensive operation (a build) on a cluster in any namespace if they are able to obtain the right information. Documenting RoleBinding here is meant to prompt cluster admins to take stock of where they are running builds, and only expose the webhook endpoint to namespaces that need it.

Current users of BuildConfig webhooks should strongly consider moving off this to OpenShift Pipelines and Pipelines as Code. This has stronger webhook protections built in and also enables additional features related to software supply chain, such as Tekton Chains.

[dustymabe]

Documenting RoleBinding here is meant to prompt cluster admins to take stock of where they are running builds, and only expose the webhook endpoint to namespaces that need it.

I thought the fact that this example includes namespace: <namespace> in the rolebinding implied that it was only taking effect on that specific namespace and wasn't clusterwide. Is that not the case?

[adambkaplan]

I thought the fact that this example includes namespace: in the rolebinding implied that it was only taking effect on that specific namespace and wasn't clusterwide. Is that not the case?

Shame on me then - I misread it (and this is why k8s RBAC is hard).

system:webhook is indeed a cluster-scoped role, and system:unauthenticated is a global user group, but RoleBinding applies the RBAC permission only to the namespace in question.

/lgtm

[adambkaplan]

/hold cancel

[jldohmann]

system:webhook is indeed a cluster-scoped role, and system:unauthenticated is a global user group, but RoleBinding applies the RBAC permission only to the namespace in question.

@adambkaplan sounds like this might be good to add as a note somewhere. either as a callout or an admonition below the code block. wdyt?