Skip to content

Commit 8379b9f

Browse files
skrthomasskrthomas
authored
Merge pull request #59913 from skrthomas/OSDOCS-5287-multi-tenancy
OSDOCS-5287: Network Observability multi-tenancy
2 parents b2dc6f8 + 4e1d3ce commit 8379b9f

File tree

3 files changed

+88
-2
lines changed

3 files changed

+88
-2
lines changed

‎modules/network-observability-auth-multi-tenancy.adoc

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
// Module included in the following assemblies:
2+
3+
// * networking/network_observability/installing-operators.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="network-observability-auth-mutli-tenancy_{context}"]
7+
= Configure authorization and multi-tenancy
8+
Define `ClusterRole` and `ClusterRoleBinding`. The `netobserv-reader` `ClusterRole` enables multi-tenancy and allows individual user access, or group access, to the flows stored in Loki. You can create a YAML file to define these roles.
9+
10+
.Procedure
11+
12+
. Using the web console, click the Import icon, *+*.
13+
. Drop your YAML file into the editor and click *Create*:
14+
+
15+
[source, yaml]
16+
----
17+
apiVersion: rbac.authorization.k8s.io/v1
18+
kind: ClusterRole
19+
metadata:
20+
name: netobserv-reader <1>
21+
rules:
22+
- apiGroups:
23+
- 'loki.grafana.com'
24+
resources:
25+
- network
26+
resourceNames:
27+
- logs
28+
verbs:
29+
- 'get'
30+
...
31+
apiVersion: rbac.authorization.k8s.io/v1
32+
kind: ClusterRole
33+
metadata:
34+
name: netobserv-writer
35+
rules:
36+
- apiGroups:
37+
- 'loki.grafana.com'
38+
resources:
39+
- network
40+
resourceNames:
41+
- logs
42+
verbs:
43+
- 'create'
44+
...
45+
apiVersion: rbac.authorization.k8s.io/v1
46+
kind: ClusterRoleBinding
47+
metadata:
48+
name: netobserv-writer-flp
49+
roleRef:
50+
apiGroup: rbac.authorization.k8s.io
51+
kind: ClusterRole
52+
name: netobserv-writer
53+
subjects:
54+
- kind: ServiceAccount
55+
name: flowlogs-pipeline <2>
56+
namespace: netobserv
57+
- kind: ServiceAccount
58+
name: flowlogs-pipeline-transformer
59+
namespace: netobserv
60+
----
61+
<1> This role can be used for multi-tenancy.
62+
<2> The `flowlogs-pipeline` writes to Loki. If you are using Kafka, this value is `flowlogs-pipeline-transformer`.

‎modules/network-observability-multitenancy.adoc

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Module included in the following assemblies:
2+
//
3+
// network_observability/observing-network-traffic.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="network-observability-multi-tenancy{context}"]
7+
= Enable multi-tenancy in Network Observability
8+
Multi-tenancy in the Network Observability Operator allows and restricts individual user access, or group access, to the flows stored in Loki. Access is enabled for project admins. Project admins who have limited access to some namespaces can access flows for only those namespaces.
9+
10+
.Prerequisite
11+
* You have installed link:https://catalog.redhat.com/software/containers/openshift-logging/loki-rhel8-operator/622b46bcae289285d6fcda39[Loki Operator version 5.7]
12+
* The `FlowCollector` `spec.loki.authToken` configuration must be set to `FORWARD`.
13+
* You must be logged in as a project administrator
14+
.Procedure
15+
. Authorize reading permission to `user1` by running the following command:
16+
+
17+
[source, terminal]
18+
----
19+
$ oc adm policy add-cluster-role-to-user netobserv-reader user1
20+
----
21+
+
22+
Now, the data is restricted to only allowed user namespaces. For example, a user that has access to a single namespace can see all the flows internal to this namespace, as well as flows going from and to this namespace.
23+
Project admins have access to the Administrator perspective in the {product-title} console to access the Network Flows Traffic page.

‎networking/network_observability/installing-operators.adoc

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ include::_attributes/common-attributes.adoc[]
77
toc::[]
88
Installing Loki is a prerequisite for using the Network Observability Operator. It is recommended to install Loki using the Loki Operator; therefore, these steps are documented below prior to the Network Observability Operator installation.
99

10-
The Loki Operator integrates a gateway that implements multi-tenancy and authentication with Loki for data flow storage. The *LokiStack* resource manages *Loki*, which is a scalable, highly-available, multitenant log aggregation system, and a web proxy with {product-title} authentication. The *LokiStack* proxy uses {product-title} authentication to enforce multi-tenancy and facilitate the saving and indexing of data in *Loki* log stores.
10+
The Loki Operator integrates a gateway that implements multi-tenancy & authentication with Loki for data flow storage. The *LokiStack* resource manages *Loki*, which is a scalable, highly-available, multi-tenant log aggregation system, and a web proxy with {product-title} authentication. The *LokiStack* proxy uses {product-title} authentication to enforce multi-tenancy and facilitate the saving and indexing of data in *Loki* log stores.
1111

1212
[NOTE]
1313
====
@@ -17,7 +17,8 @@ The Loki Operator can also be used for xref:../../logging/cluster-logging-loki.a
1717
include::modules/network-observability-loki-install.adoc[leveloffset=+1]
1818
include::modules/network-observability-lokistack-create.adoc[leveloffset=+2]
1919
include::modules/network-observability-lokistack-ingestion-query.adoc[leveloffset=+2]
20-
include::modules/network-observability-roles-create.adoc[leveloffset=+1]
20+
include::modules/network-observability-auth-multi-tenancy.adoc[leveloffset=+1]
21+
include::modules/network-observability-multitenancy.adoc[leveloffset=+1]
2122
include::modules/network-observability-kafka-option.adoc[leveloffset=+1]
2223
include::modules/network-observability-operator-install.adoc[leveloffset=+1]
2324

0 commit comments

Comments
 (0)