Skip to content

Commit 42a2264

Browse files
bene2k1bene2k1
committed
feat(k8s): iam and rbac
1 parent 3de2f49 commit 42a2264

File tree

2 files changed

+293
-0
lines changed

2 files changed

+293
-0
lines changed

‎pages/kubernetes/how-to/manage-kubeconfig-with-iam.mdx‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
meta:
3+
title: How to manage Kubeconfig files with IAM
4+
description: This page explains how to manage Scaleway Kubeconfig files with IAM
5+
content:
6+
h1: How to manage Kubeconfig files with IAM
7+
paragraph: This page explains how to manage Scaleway Kubeconfig files with IAM
8+
tags: kubernetes kapsule-cluser
9+
dates:
10+
validation: 2025-06-02
11+
posted: 2025-06-02
12+
categories:
13+
- kubernetes
14+
---
15+
16+
A Kubeconfig file serves as a repository for essential credentials required to access a Kubernetes cluster and manage deployments.
17+
This file contains critical information, including cluster details, authentication data, and context information, allowing users to oversee and configure their Kubernetes clusters.
18+
19+
Scaleway's Identity and Access Management (IAM) is now being used to generate Kubeconfig files. This integration offers several advantages:
20+
21+
- **Improved user administration:**
22+
- When removing a cluster user, there is no longer a need to reset the admin token, mitigating security risks.
23+
- **Increased cluster security:**
24+
- Each user has unique credentials, enhancing security.
25+
- Audit logs facilitate the identification of specific Kubernetes users.
26+
- **Enhanced application security:**
27+
- Applications within the cluster are authenticated using specific tokens.
28+
- This authentication method is particularly useful when a pod needs to interact with the Kubernetes API, as it can authenticate using its associated [Service Account](https://kubernetes.io/docs/concepts/security/service-accounts/).
29+
30+
[Identity and Access Management (IAM)](/iam/concepts/#iam) provides control over resource access. IAM policies enable the configuration of permissions for Kubernetes Kapsule clusters at the Project level.
31+
32+
An [IAM policy](/iam/concepts/#policy) defines the permissions for users, groups, and applications within an Organization. It consists of a [principal](/iam/concepts/#principal) (the user, group, or application to which it applies) and IAM rules that specify permission sets and their scope.
33+
34+
The [combination of IAM and Kubernetes RBAC (Role-based Acccess Control)](/kubernetes/reference-content/set-iam-permissions-and-implement-rbac/) allows you to define fine-grained access levels for cluster users.
35+
36+
<Macro id="iam-requirements" />
37+
38+
<Message type="requirement">
39+
- A Scaleway account logged into the [console](https://console.scaleway.com)
40+
- [Created](/kubernetes/how-to/create-cluster) a Kubernetes Kapsule cluster
41+
</Message>
42+
43+
## Setting up access
44+
45+
1. [Create a group](/iam/how-to/create-group/) named `k8s-group` that contains the user and the application, so they are the only ones to have access to your cluster.
46+
2. [Create an IAM policy](/iam/how-to/create-policy/) named `k8s-policy` in the Scaleway console, with the previously created group as a [principal](/iam/concepts/#principal). Apply the corresponding IAM policy to the group. For example, `KubernetesFullAccess`.
47+
<Message type="tip">
48+
Refer to [Setting IAM permissions and implement RBAC on a cluster](/kubernetes/reference-content/set-iam-permissions-and-implement-rbac/) for a detailed overview about the available IAM permissions and how to fine-tune them using Kubernetes RBAC.
49+
</Message>
50+
51+
## Downloading the Kubeconfig file
52+
53+
1. Click **Kubernetes** in the **Containers** section of the [Scaleway console](https://console.scaleway.com) side menu. The Kubernetes Kapsule overview displays.
54+
2. Click the name of the cluster you want to access. The cluster overview page displays. Click on the name of the cluster you want to manage.
55+
3. Scroll down to the **Download kubeconfig with IAM** section of the page.
56+
4. Click **Download kubeconfig**
57+
5. Select the API key bearer, enter a description and set the expiration date for the kubeconfig file, then click **Generate kubeconfig**.
58+
6. Download the kubeconfig file and export the path to start using it with `kubectl`.
59+
60+
You can now manage your cluster using `kubectl`. For more information about this tool, refer to the [official kubectl documentation](https://kubernetes.io/docs/reference/kubectl/).

‎pages/kubernetes/reference-content/set-iam-permissions-and-implement-rbac.mdx‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
---
2+
meta:
3+
title: Setting IAM permissions and implement RBAC on a cluster
4+
description: This page explains how to set IAM permissions and implement RBAC on a Scaleway Kubernetes cluster
5+
content:
6+
h1: Setting IAM permissions and implement RBAC on a cluster
7+
paragraph: This page explains how to set IAM permissions and implement RBAC on a Scaleway Kubernetes cluster
8+
tags: kubernetes kapsule-cluser
9+
dates:
10+
validation: 2025-06-02
11+
posted: 2025-06-02
12+
categories:
13+
- kubernetes
14+
---
15+
16+
Role-based access control (RBAC) is a native feature of Kubernetes and a method of regulating access to compute or network resources based on the roles of individual users within your Organization.
17+
The feature is activated on Scaleway Kubernetes Kapsule and Kosmos by default and is compatible with Scaleway's IAM service.
18+
IAM and RBAC work together by integrating Scaleway’s Identity and Access Management with Kubernetes' native RBAC system. This integration ensures that access permissions are consistent across both the cloud infrastructure and the Kubernetes cluster, providing a secure access control mechanism.
19+
It allows you to assign roles to users, groups or `ServicesAccount` via `RoleBindings` and `ClusterRoleBindings`.
20+
21+
Key components of RBAC in Kubernetes include:
22+
23+
- **Roles and ClusterRoles:**
24+
- **Roles:** These are specific to a namespace and define a set of permissions for resources within that namespace (e.g., pods, services).
25+
- **ClusterRoles:** These are similar to roles but apply cluster-wide, spanning across all namespaces.
26+
- **RoleBindings and ClusterRoleBindings:**
27+
- **RoleBindings:** These associate a set of permissions defined in a role with a user, group, or service account within a specific namespace.
28+
- **ClusterRoleBindings:** These associate a set of permissions defined in a ClusterRole with a user, group, or service account across the entire cluster.
29+
- **Subjects:** A subject in RBAC can be a user, a group, or a service account to which roles or cluster roles are bound.
30+
- **Rules:** Rules are sets of permissions associated with roles or cluster roles. They specify what actions are allowed or denied on specific resources.
31+
32+
RBAC works seamlessly with Scaleway's IAM (Identity and Access Maanagement) system. Refer to [How to manage Kubeconfig files with IAM](/containers/kubernetes/how-to/manage-kubeconfig-with-iam/) for information how to configure IAM permissions for your users.
33+
34+
### Mapping IAM permission sets to Kubernetes groups
35+
36+
The following IAM permission sets are mapped to Kubernetes groups:
37+
38+
| IAM Permission Set | Kubernetes Group | Notes |
39+
|----------------------------------|-----------------------------|--------------------------|
40+
| KubernetesFullAccess | scaleway:cluster-write | |
41+
| | scaleway:cluster-read | |
42+
| KubernetesReadOnly | scaleway:cluster-read | |
43+
| KubernetesSystemMastersGroupAccess | system:masters | God mode |
44+
45+
### Default ClusterRoleBindings
46+
47+
Default `ClusterRoleBinding` and `ClusterRole` configurations have been set up:
48+
49+
| Group | ClusterRoleBinding | ClusterRole |
50+
|----------------------------------|-----------------------------|--------------------------|
51+
| scaleway:cluster-write | scaleway:cluster-write | scaleway:cluster-write |
52+
| scaleway:cluster-read | scaleway:cluster-read | scaleway:cluster-read |
53+
54+
These groups can be edited and will not be reconciled by Kapsule/Kosmos. If these roles are misconfigured and cut off access to the cluster, the IAM permission set `KubernetesSystemMastersGroupAccess` should be assigned to the application or user. This permission set allows bypassing the entire RBAC layer.
55+
56+
Users or applications can be added to zero, one, or more IAM groups. IAM groups are mapped to Kubernetes groups in the format `scaleway:groups:GROUPID`.
57+
58+
**Example:**
59+
60+
```bash
61+
$ kubectl auth whoami
62+
ATTRIBUTE VALUE
63+
Username scaleway:bearer:dea0a399-af6e-4e8b-b2dd-32c9a26a174b
64+
UID dea0a399-af6e-4e8b-b2dd-32c9a26a174b
65+
Groups [scaleway:group:d4f154d6-a93c-4bab-a599-5f3803bd5120 scaleway:cluster-read system:authenticated]
66+
```
67+
68+
## Creating a developers group with write access to dev and staging namespaces
69+
70+
1. Create an IAM developers group:
71+
- Assign the `KubernetesReadOnly` permission set to this group.
72+
- Note the group ID, as it will be needed later.
73+
74+
2. Create Namespaces and Roles:
75+
- As a user/app with `KubernetesFullAccess` or `KubernetesSystemMastersGroupAccess`, create the following manifests:
76+
77+
Namespace Creation:
78+
79+
```yaml
80+
apiVersion: v1
81+
kind: Namespace
82+
metadata:
83+
name: dev
84+
---
85+
apiVersion: v1
86+
kind: Namespace
87+
metadata:
88+
name: staging
89+
```
90+
91+
Role Creation for dev namespace:
92+
93+
```yaml
94+
apiVersion: rbac.authorization.k8s.io/v1
95+
kind: Role
96+
metadata:
97+
name: developers
98+
namespace: dev
99+
rules:
100+
- apiGroups: ["*"]
101+
resources: ["*"]
102+
verbs: ["*"]
103+
- nonResourceURLs: ["*"]
104+
verbs: ["*"]
105+
```
106+
107+
RoleBinding Creation for dev namespace:
108+
109+
```yaml
110+
apiVersion: rbac.authorization.k8s.io/v1
111+
kind: RoleBinding
112+
metadata:
113+
name: developers
114+
namespace: dev
115+
subjects:
116+
- kind: Group
117+
name: scaleway:groups:<GROUP_ID>
118+
roleRef:
119+
kind: Role
120+
name: developers
121+
apiGroup: rbac.authorization.k8s.io
122+
```
123+
124+
Repeat the same operation for the staging namespace.
125+
126+
3. Apply the Manifests:
127+
128+
```bash
129+
kubectl apply -f filename.yaml
130+
```
131+
132+
After these steps, members of the IAM group will have read access to the cluster and write access to the `dev` and `staging` namespaces. Permissions can be refined by modifying the `Role`.
133+
134+
## Assigning permissions to a specific user without using a group
135+
136+
1. **Assign the `KubernetesReadOnly` Permission Set to the User**.
137+
2. **Retrieve the IAM User ID** and note it.
138+
3. **Create the Following Manifests**:
139+
140+
Namespace creation:
141+
142+
```yaml
143+
apiVersion: v1
144+
kind: Namespace
145+
metadata:
146+
name: demo-sandbox
147+
```
148+
149+
Role creation for an example namespace:
150+
151+
```yaml
152+
apiVersion: rbac.authorization.k8s.io/v1
153+
kind: Role
154+
metadata:
155+
name: example
156+
namespace: example-sandbox
157+
rules:
158+
- apiGroups: ["*"]
159+
resources: ["*"]
160+
verbs: ["*"]
161+
- nonResourceURLs: ["*"]
162+
verbs: ["*"]
163+
```
164+
165+
RoleBinding creation for the example namespace:
166+
167+
```yaml
168+
apiVersion: rbac.authorization.k8s.io/v1
169+
kind: RoleBinding
170+
metadata:
171+
name: example
172+
namespace: example-sandbox
173+
subjects:
174+
- kind: User
175+
name: scaleway:bearer:<USER_ID>
176+
roleRef:
177+
kind: Role
178+
name: demo
179+
apiGroup: rbac.authorization.k8s.io
180+
```
181+
182+
4. Apply the manifests:
183+
184+
```bash
185+
kubectl apply -f filename.yaml
186+
```
187+
188+
User "demo" now has full rights in the `example-sandbox` namespace.
189+
190+
## Limiting `cluster-read` Access
191+
192+
To modify the `scaleway:cluster-read` permissions, use the following command:
193+
194+
```bash
195+
kubectl edit clusterrole scaleway:cluster-read
196+
```
197+
198+
Default content:
199+
200+
```yaml
201+
apiVersion: rbac.authorization.k8s.io/v1
202+
kind: ClusterRole
203+
metadata:
204+
name: scaleway:cluster-read
205+
rules:
206+
- verbs: ["get", "list", "watch"]
207+
apiGroups: [""]
208+
resources: ["bindings", "configmaps", "endpoints", "events", "limitranges", "namespaces", "namespaces/status", "nodes", "persistentvolumeclaims", "persistentvolumeclaims/status", "pods", "pods/log", "pods/status", "replicationcontrollers", "replicationcontrollers/scale", "replicationcontrollers/status", "resourcequotas", "resourcequotas/status", "serviceaccounts", "services", "services/status"]
209+
- verbs: ["get", "list", "watch"]
210+
apiGroups: ["metrics.k8s.io"]
211+
resources: ["pods", "nodes"]
212+
- verbs: ["get", "list", "watch"]
213+
apiGroups: ["apps"]
214+
resources: ["controllerrevisions", "daemonsets", "daemonsets/status", "deployments", "deployments/scale", "deployments/status", "replicasets", "replicasets/scale", "replicasets/status", "statefulsets", "statefulsets/scale", "statefulsets/status"]
215+
- verbs: ["get", "list", "watch"]
216+
apiGroups: ["autoscaling"]
217+
resources: ["horizontalpodautoscalers", "horizontalpodautoscalers/status"]
218+
- verbs: ["get", "list", "watch"]
219+
apiGroups: ["batch"]
220+
resources: ["cronjobs", "cronjobs/status", "jobs", "jobs/status"]
221+
- verbs: ["get", "list", "watch"]
222+
apiGroups: ["extensions"]
223+
resources: ["daemonsets", "daemonsets/status", "deployments", "deployments/scale", "deployments/status", "ingresses", "ingresses/status", "networkpolicies", "replicasets", "replicasets/scale", "replicasets/status", "replicationcontrollers/scale"]
224+
- verbs: ["get", "list", "watch"]
225+
apiGroups: ["policy"]
226+
resources: ["poddisruptionbudgets", "poddisruptionbudgets/status"]
227+
- verbs: ["get", "list", "watch"]
228+
apiGroups: ["networking.k8s.io"]
229+
resources: ["ingresses", "ingresses/status", "networkpolicies"]
230+
- verbs: ["get", "list", "watch"]
231+
apiGroups: ["rbac.authorization.k8s.io"]
232+
resources: ["rolebindings", "roles"]
233+
```

0 commit comments

Comments
 (0)