[v0.5] s4: Fixes 374

docs.md

@@ -60,7 +60,9 @@ Only 1 clusterproxyconfig per downstream cluster is ever permitted.
 
 #### Escalation Prevention
 
-Users can only create/update ClusterRoleTemplateBindings which grant permissions to RoleTemplates with rights less than or equal to those they currently possess. This is to prevent privilege escalation. 
+Users can only create/update ClusterRoleTemplateBindings which grant permissions to RoleTemplates with rights less than or equal to those they currently possess. This is to prevent privilege escalation.
+For external RoleTemplates (RoleTemplates with `external` set to `true`), if the `external-rules` feature flag is enabled and `ExternalRules` is specified in the roleTemplate in `RoleTemplateName`,
+`ExternalRules` will be used for authorization. Otherwise (if the feature flag is off or `ExternalRules` are nil), the rules from the backing `ClusterRole` in the local cluster will be used.
 
 #### Invalid Fields - Create
 
@@ -99,6 +101,7 @@ In addition, as in the create validation, both a user subject and a group subjec
 #### On update
 
 The desired value must not change on new spec unless it's equal to the `lockedValue` or `lockedValue` is nil.
+Due to the security impact of the `external-rules` feature flag, only users with admin permissions (`*` verbs on `*` resources in `*` APIGroups in all namespaces) can enable or disable this feature flag.
 
 ## FleetWorkspace 
 
@@ -226,6 +229,8 @@ Adds the authz.management.cattle.io/creator-role-bindings annotation.
 
 Users can only create/update ProjectRoleTemplateBindings with rights less than or equal to those they currently possess.
 This is to prevent privilege escalation.
+For external RoleTemplates (RoleTemplates with `external` set to `true`), if the `external-rules` feature flag is enabled and `ExternalRules` is specified in the roleTemplate in `RoleTemplateName`,
+`ExternalRules` will be used for authorization. Otherwise, if `ExternalRules` are nil when the feature flag is on, the rules from the backing `ClusterRole` in the local cluster will be used.
 
 #### Invalid Fields - Create
 
@@ -275,11 +280,12 @@ Circular references to a `RoleTemplate` (a inherits b, b inherits a) are not all
 
 #### Rules Without Verbs, Resources, API groups
 
-Rules without verbs, resources, or apigroups are not permitted. The `rules` included in a RoleTemplate are of the same type as the rules used by standard Kubernetes RBAC types (such as `Roles` from `rbac.authorization.k8s.io/v1`). Because of this, they inherit the same restrictions as these types, including this one.
+Rules without verbs, resources, or apigroups are not permitted. The `rules` and `externalRules` included in a RoleTemplate are of the same type as the rules used by standard Kubernetes RBAC types (such as `Roles` from `rbac.authorization.k8s.io/v1`). Because of this, they inherit the same restrictions as these types, including this one.
 
 #### Escalation Prevention
 
 Users can only change RoleTemplates with rights less than or equal to those they currently possess. This prevents privilege escalation. 
+Users can't create external RoleTemplates (or update existing RoleTemplates) with `ExternalRules` without having the `escalate` verb on that RoleTemplate.
 
 #### Context Validation
 

go.mod

@@ -39,15 +39,15 @@ require (
 	github.com/gorilla/mux v1.8.1
 	github.com/rancher/dynamiclistener v0.5.0-rc6
 	github.com/rancher/lasso v0.0.0-20240424194130-d87ec407d941
-	github.com/rancher/rancher/pkg/apis v0.0.0-20240529165126-aacda464b851
-	github.com/rancher/rke v1.6.0-rc4
+	github.com/rancher/rancher/pkg/apis v0.0.0-20240618122559-b9ec494d4f6f
+	github.com/rancher/rke v1.6.0-rc6
 	github.com/rancher/wrangler/v2 v2.2.0-rc6
 	github.com/robfig/cron v1.2.0
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.9.0
 	golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f
-	golang.org/x/text v0.15.0
-	golang.org/x/tools v0.20.0
+	golang.org/x/text v0.16.0
+	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d
 	k8s.io/api v0.29.4
 	k8s.io/apimachinery v0.29.4
 	k8s.io/apiserver v0.29.4
@@ -105,10 +105,10 @@ require (
 	github.com/prometheus/client_model v0.6.1 // indirect
 	github.com/prometheus/common v0.47.0 // indirect
 	github.com/prometheus/procfs v0.14.0 // indirect
-	github.com/rancher/aks-operator v1.9.0-rc.1 // indirect
-	github.com/rancher/eks-operator v1.9.0-rc.1 // indirect
-	github.com/rancher/fleet/pkg/apis v0.9.4 // indirect
-	github.com/rancher/gke-operator v1.9.0-rc.1 // indirect
+	github.com/rancher/aks-operator v1.9.0-rc.6 // indirect
+	github.com/rancher/eks-operator v1.9.0-rc.5 // indirect
+	github.com/rancher/fleet/pkg/apis v0.10.0-rc.16 // indirect
+	github.com/rancher/gke-operator v1.9.0-rc.4 // indirect
 	github.com/rancher/norman v0.0.0-20240503193601-9f5f6586bb5b // indirect
 	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
@@ -127,13 +127,13 @@ require (
 	go.opentelemetry.io/proto/otlp v1.2.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/crypto v0.23.0 // indirect
+	golang.org/x/crypto v0.24.0 // indirect
 	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/net v0.26.0 // indirect
 	golang.org/x/oauth2 v0.20.0 // indirect
 	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.20.0 // indirect
-	golang.org/x/term v0.20.0 // indirect
+	golang.org/x/sys v0.21.0 // indirect
+	golang.org/x/term v0.21.0 // indirect
 	golang.org/x/time v0.5.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20240429193739-8cf5692501f6 // indirect

go.sum

@@ -124,8 +124,8 @@ github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9G
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/onsi/ginkgo/v2 v2.17.2 h1:7eMhcy3GimbsA3hEnVKdw/PQM9XN9krpKVXsZdph0/g=
-github.com/onsi/ginkgo/v2 v2.17.2/go.mod h1:nP2DPOQoNsQmsVyv5rDA8JkXQoCs6goXIvr/PRJ1eCc=
+github.com/onsi/ginkgo/v2 v2.19.0 h1:9Cnnf7UHo57Hy3k6/m5k3dRfGTMXGvxhHFvkDTCTpvA=
+github.com/onsi/ginkgo/v2 v2.19.0/go.mod h1:rlwLi9PilAFJ8jCg9UE1QP6VBpd6/xj3SRC0d6TU0To=
 github.com/onsi/gomega v1.33.1 h1:dsYjIxxSR755MDmKVsaFQTE22ChNBcuuTWgkUDSubOk=
 github.com/onsi/gomega v1.33.1/go.mod h1:U4R44UsT+9eLIaYRB2a5qajjtQYn0hauxvRm16AVYg0=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -142,26 +142,26 @@ github.com/prometheus/common v0.47.0 h1:p5Cz0FNHo7SnWOmWmoRozVcjEp0bIVU8cV7OShpj
 github.com/prometheus/common v0.47.0/go.mod h1:0/KsvlIEfPQCQ5I2iNSAWKPZziNCvRs5EC6ILDTlAPc=
 github.com/prometheus/procfs v0.14.0 h1:Lw4VdGGoKEZilJsayHf0B+9YgLGREba2C6xr+Fdfq6s=
 github.com/prometheus/procfs v0.14.0/go.mod h1:XL+Iwz8k8ZabyZfMFHPiilCniixqQarAy5Mu67pHlNQ=
-github.com/rancher/aks-operator v1.9.0-rc.1 h1:bF5ch8ToIyNZJT8/LxAmJ1oIeGEiEc1YUVQAx1k6l6c=
-github.com/rancher/aks-operator v1.9.0-rc.1/go.mod h1:9bS815Zlu5Gj/CCdFnYJASxJj7IJMZluoLwFJ8e8Arc=
+github.com/rancher/aks-operator v1.9.0-rc.6 h1:ijN3MhhEXaoFRcmh8BJbq1kj+H1OhJFBLl9R7SIMqMs=
+github.com/rancher/aks-operator v1.9.0-rc.6/go.mod h1:5zVtyyMAhWg98qMd6uRtiuT582UoId6UmHod50mwkvI=
 github.com/rancher/client-go v1.29.3-rancher1 h1:4nZ6BEtFLxBSomVgJFSCoOAmfo6hr8PYMwnsZk1Ubu8=
 github.com/rancher/client-go v1.29.3-rancher1/go.mod h1:tkDisCvgPfiRpxGnOORfkljmS+UrW+WtXAy2fTvXJB0=
 github.com/rancher/dynamiclistener v0.5.0-rc6 h1:F/WVZ/asQAHIVxBq7Q448ORfnKti4vhGtdNOweZxuT0=
 github.com/rancher/dynamiclistener v0.5.0-rc6/go.mod h1:dDgzEszqQTOnXq2vulbHVXeitbngEnNU0bZoV8qAIYw=
-github.com/rancher/eks-operator v1.9.0-rc.1 h1:f0btgym2q+q2fpxJbopZMuXPW0iNt3SMgAeRFS0RJrc=
-github.com/rancher/eks-operator v1.9.0-rc.1/go.mod h1:siEaksmkrVdKsbopcUUDcnBiacKfqsHqn1GvTNF7QOQ=
-github.com/rancher/fleet/pkg/apis v0.9.4 h1:j33fWX6cISYHY+fBUxRxLc6uoAnXFcTe+sz54WSVDU4=
-github.com/rancher/fleet/pkg/apis v0.9.4/go.mod h1:M5SFmUxZXWITBqVHWanrmP43yucyLOaA5xDQhI206T8=
-github.com/rancher/gke-operator v1.9.0-rc.1 h1:Q7CXTKxSZ9EEZ9Te+QtE6ZLL7Zfx3e09PoFp1isu+Ec=
-github.com/rancher/gke-operator v1.9.0-rc.1/go.mod h1:X13Mv1G7hjPU1At8sT/3c/LOpNqjbweubKHs/VimUVk=
+github.com/rancher/eks-operator v1.9.0-rc.5 h1:UlsBAz5YIj+952dOl0PNhATTK7lOHycC6LmY7gLNXds=
+github.com/rancher/eks-operator v1.9.0-rc.5/go.mod h1:B6Kg6cHYxPU54YOemHVCrN0lsuOpjizbnbiIskzOvyM=
+github.com/rancher/fleet/pkg/apis v0.10.0-rc.16 h1:M35Fk9q3ttZjHCOCCmaN8i4teqSso8tetIzxNtm8lyU=
+github.com/rancher/fleet/pkg/apis v0.10.0-rc.16/go.mod h1:AO27VlVcMra5roVMpe76QWo4YOr1V4dnfu4e2a2C9bw=
+github.com/rancher/gke-operator v1.9.0-rc.4 h1:65gwsm0IiLWn5u1gO522tphuv7XWfSNGWiXY3b8KiBE=
+github.com/rancher/gke-operator v1.9.0-rc.4/go.mod h1:hx4qmnYG4cRsD/ywVyKgWWQWAOZhE3L9RgXBKppqRrU=
 github.com/rancher/lasso v0.0.0-20240424194130-d87ec407d941 h1:1SvuoeyfANRvKVJUSzHWa1P781iuH8ktUjW9cPOxAAk=
 github.com/rancher/lasso v0.0.0-20240424194130-d87ec407d941/go.mod h1:pYKOe2r/5O0w3ypoc7xHQF8LvWCp5PsNRea1Jpq3vBU=
 github.com/rancher/norman v0.0.0-20240503193601-9f5f6586bb5b h1:9k8VOhRi6ZIZ8rBlQG8ON9eG+ukqThNeXJ2e6CzZO78=
 github.com/rancher/norman v0.0.0-20240503193601-9f5f6586bb5b/go.mod h1:xJ0CLJUG9SvtyuPzPA8ATh2SjwiqXGfE+pPh7uVhJzQ=
-github.com/rancher/rancher/pkg/apis v0.0.0-20240529165126-aacda464b851 h1:iIW8Wyy9W82JKCihmb0QAGHJz8gsQOw5V+Rjc2swuY4=
-github.com/rancher/rancher/pkg/apis v0.0.0-20240529165126-aacda464b851/go.mod h1:5QLxSuI6bJ+eAyjOVJVDSMgu93rA6sYF9BWTvk74JRQ=
-github.com/rancher/rke v1.6.0-rc4 h1:5ytUakGjIGGwtG0uB6bnwMqbRoK8ZPiOAUPl6V12Vcw=
-github.com/rancher/rke v1.6.0-rc4/go.mod h1:zvrJLRt+84/OMOUO0AggVqW6a2RSsTjqSW8bDHvKgME=
+github.com/rancher/rancher/pkg/apis v0.0.0-20240618122559-b9ec494d4f6f h1:iBjEEgo+10iz9by+/15d7Z93b8BV5zW0tYIa1zZKKlY=
+github.com/rancher/rancher/pkg/apis v0.0.0-20240618122559-b9ec494d4f6f/go.mod h1:r0QxIKiKKqD3ZkLuJNQMUt0tjwClUWEtV6b9CXCMQFE=
+github.com/rancher/rke v1.6.0-rc6 h1:FUZvy/RHpHcT84rWlrl9VrO//mp5sKXsbbvEm5JdM8A=
+github.com/rancher/rke v1.6.0-rc6/go.mod h1:6ruRFiHrhT1KQvbmKycjKh8OIa2PG6fshP2Q5CLUyR4=
 github.com/rancher/wrangler/v2 v2.2.0-rc6 h1:jMsuOVl7nBuQ5QJqdNkR2yHEf1+rYiyd1gN+mQzIcag=
 github.com/rancher/wrangler/v2 v2.2.0-rc6/go.mod h1:rFxhBR+PpC1MuJli+JeMpxoGxfV7XdFWtpdLC8s+oWQ=
 github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ=
@@ -239,8 +239,8 @@ go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
+golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
 golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f h1:99ci1mjWVBWwJiEKYY6jWa4d2nTQVIEhZIptnrVb1XY=
 golang.org/x/exp v0.0.0-20240416160154-fe59bbe5cc7f/go.mod h1:/lliqkxwWAhPjf5oSOIJup2XcqJaw8RGS6k3TGEc7GI=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
@@ -253,8 +253,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.26.0 h1:soB7SVo0PWrY4vPW/+ay0jKDNScG2X9wFeYlXIvJsOQ=
+golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE=
 golang.org/x/oauth2 v0.20.0 h1:4mQdhULixXKP1rwYBW0vAijoXnkTG0BLCDRzfe1idMo=
 golang.org/x/oauth2 v0.20.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -270,15 +270,15 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.20.0 h1:VnkxpohqXaOBYJtBmEppKUG6mXpi+4O6purfc2+sMhw=
-golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
+golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
+golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
 golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -287,8 +287,8 @@ golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
-golang.org/x/tools v0.20.0 h1:hz/CVckiOxybQvFw6h7b/q80NTr9IUQb4s1IIzW7KNY=
-golang.org/x/tools v0.20.0/go.mod h1:WvitBU7JJf6A4jOdg4S1tviW9bhUxkgeCui/0JHctQg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
+golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

pkg/auth/globalrole_test.go

@@ -153,7 +153,7 @@ func TestGlobalRulesFromRole(t *testing.T) {
 			if test.stateSetup != nil {
 				test.stateSetup(state)
 			}
-			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil), nil)
+			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil, nil), nil)
 			rules := grResolver.GlobalRulesFromRole(test.globalRole)
 
 			require.Len(t, rules, len(test.wantRules))
@@ -264,7 +264,7 @@ func TestClusterRulesFromRole(t *testing.T) {
 			if test.stateSetup != nil {
 				test.stateSetup(state)
 			}
-			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil), nil)
+			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil, nil), nil)
 			rules, err := grResolver.ClusterRulesFromRole(test.globalRole)
 			if test.wantErr {
 				require.Error(t, err)
@@ -337,7 +337,7 @@ func TestGetRoleTemplatesForGlobalRole(t *testing.T) {
 			if test.stateSetup != nil {
 				test.stateSetup(state)
 			}
-			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil), nil)
+			grResolver := auth.NewGlobalRoleResolver(auth.NewRoleTemplateResolver(state.rtCacheMock, nil, nil), nil)
 			roleTemplates, err := grResolver.GetRoleTemplatesForGlobalRole(test.globalRole)
 			if test.wantErr {
 				require.Error(t, err)

pkg/auth/roleTemplate.go

@@ -9,17 +9,21 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 )
 
+const ExternalRulesFeature = "external-rules"
+
 // RoleTemplateResolver provides an interface to flatten role templates into slice of rules.
 type RoleTemplateResolver struct {
 	roleTemplates v3.RoleTemplateCache
 	clusterRoles  v1.ClusterRoleCache
+	features      v3.FeatureCache
 }
 
 // NewRoleTemplateResolver creates a newly allocated RoleTemplateResolver from the provided caches
-func NewRoleTemplateResolver(roleTemplates v3.RoleTemplateCache, clusterRoles v1.ClusterRoleCache) *RoleTemplateResolver {
+func NewRoleTemplateResolver(roleTemplates v3.RoleTemplateCache, clusterRoles v1.ClusterRoleCache, features v3.FeatureCache) *RoleTemplateResolver {
 	return &RoleTemplateResolver{
 		roleTemplates: roleTemplates,
 		clusterRoles:  clusterRoles,
+		features:      features,
 	}
 }
 
@@ -58,12 +62,29 @@ func (r *RoleTemplateResolver) RulesFromTemplate(roleTemplate *rancherv3.RoleTem
 func (r *RoleTemplateResolver) gatherRules(roleTemplate *rancherv3.RoleTemplate, rules []rbacv1.PolicyRule, seen map[string]bool) ([]rbacv1.PolicyRule, error) {
 	seen[roleTemplate.Name] = true
 
-	if roleTemplate.External && roleTemplate.Context == "cluster" {
-		cr, err := r.clusterRoles.Get(roleTemplate.Name)
+	if roleTemplate.External {
+		externalRulesEnabled, err := r.isExternalRulesFeatureFlagEnabled()
 		if err != nil {
-			return nil, fmt.Errorf("failed to get clusterRoles '%s': %w", roleTemplate.Name, err)
+			return nil, fmt.Errorf("failed to check externalRules feature flag: %w", err)
+		}
+
+		if externalRulesEnabled {
+			if roleTemplate.ExternalRules != nil {
+				rules = append(rules, roleTemplate.ExternalRules...)
+			} else {
+				cr, err := r.clusterRoles.Get(roleTemplate.Name)
+				if err != nil {
+					return nil, fmt.Errorf("for external RoleTemplates, externalRules must be provided or a backing clusterRole must be installed to check for privilege escalations: failed to get ClusterRole %q: %w", roleTemplate.Name, err)
+				}
+				rules = append(rules, cr.Rules...)
+			}
+		} else if roleTemplate.Context == "cluster" {
+			cr, err := r.clusterRoles.Get(roleTemplate.Name)
+			if err != nil {
+				return nil, fmt.Errorf("failed to get ClusterRole %q: %w", roleTemplate.Name, err)
+			}
+			rules = append(rules, cr.Rules...)
 		}
-		rules = append(rules, cr.Rules...)
 	}
 
 	rules = append(rules, roleTemplate.Rules...)
@@ -84,3 +105,14 @@ func (r *RoleTemplateResolver) gatherRules(roleTemplate *rancherv3.RoleTemplate,
 	}
 	return rules, nil
 }
+
+func (r *RoleTemplateResolver) isExternalRulesFeatureFlagEnabled() (bool, error) {
+	f, err := r.features.Get(ExternalRulesFeature)
+	if err != nil {
+		return false, err
+	}
+	if f.Spec.Value == nil {
+		return f.Status.Default, nil
+	}
+	return *f.Spec.Value, nil
+}