feature: Manage RBAC Entities

[tjrivera]

Problem

My team currently leverages Kong's Enterprise Edition RBAC features to manage access to our control-plane.

We currently use some custom tooling that depends on go-kong to create custom roles, but we'd prefer to manage RBAC roles (and their associated endpoints and permissions) in a declarative format. i.e.

_format_version: "1.1"
services:
- connect_timeout: 60000
  host: localhost
  name: foo-service
  path: /
  port: 8001
  protocol: http
  read_timeout: 60000
  retries: 5
  write_timeout: 60000
  tags:
  - foo
  routes:
  - id: 6c6a94ff-4404-4e80-8c57-e6506eea4492
    paths:
    - /foo
    path_handling: v0
    preserve_host: false
    protocols:
    - http
    regex_priority: 0
    strip_path: true
    tags:
    - foo
    https_redirect_status_code: 426
plugins:
- name: rate-limiting
  config:
    day: null
    header_name: null
    hour: 10000
    limit_by: consumer
    minute: null
    month: null
    path: null
    policy: local
    second: null
    year: null
  enabled: true
  protocols:
  - grpc
  - grpcs
  - http
  - https
rbac_roles:
- name: admin
  comment: Full access to all endpoints, across all workspaces—except RBAC Admin API
  is_default: false
  endpoint_permissions:
  - workspace: '*'
    endpoint: '*'
    actions:
    - delete
    - create
    - update
    - read
    negative: false
  - workspace: '*'
    endpoint: /rbac/*
    actions:
    - delete
    - create
    - update
    - read
    negative: true
  - workspace: '*'
    endpoint: /rbac/*/*
    actions:
    - delete
    - create
    - update
    - read
    negative: true
  - workspace: '*'
    endpoint: /rbac/*/*/*
    actions:
    - delete
    - create
    - update
    - read
    negative: true
  - workspace: '*'
    endpoint: /rbac/*/*/*/*
    actions:
    - delete
    - create
    - update
    - read
    negative: true
  - workspace: '*'
    endpoint: /rbac/*/*/*/*/*
    actions:
    - delete
    - create
    - update
    - read
    negative: true
- name: super-admin
  comment: Full access to all endpoints, across all workspaces
  is_default: false
  endpoint_permissions:
  - workspace: '*'
    endpoint: '*'
    actions:
    - delete
    - create
    - update
    - read
    negative: false

Entities

• RBACRole
• RBACEndpointPermission
• RBACEntityPermission

I have about 60% of this work complete but would like to get an issue up to track the feature.