Skip to content

Commit 5b48a1f

Browse files
bene2k1RoRoJjcirinosclwy
authored
feat(k8s): iam and rbac (#5050)
* feat(k8s): iam and rbac * feat(k8s): iam * feat(k8s): iam * Apply suggestions from code review * Apply suggestions from code review * Apply suggestions from code review Co-authored-by: Rowena Jones <[email protected]> * Apply suggestions from code review Co-authored-by: Jessica <[email protected]> --------- Co-authored-by: Rowena Jones <[email protected]> Co-authored-by: Jessica <[email protected]>
1 parent cfcf806 commit 5b48a1f

File tree

2 files changed

+353
-0
lines changed

2 files changed

+353
-0
lines changed

‎menu/navigation.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2003,6 +2003,10 @@
20032003
"label": "Exposing Kubernetes services to the internet",
20042004
"slug": "exposing-services"
20052005
},
2006+
{
2007+
"label": "Setting IAM permissions and implementing RBAC on a cluster",
2008+
"slug": "set-iam-permissions-and-implement-rbac"
2009+
},
20062010
{
20072011
"label": "Modifying kernel parameters in a Kubernetes cluster using a DaemonSet",
20082012
"slug": "modifying-kernel-parameters-kubernetes-cluster"

‎pages/kubernetes/reference-content/set-iam-permissions-and-implement-rbac.mdx‎

Lines changed: 349 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,349 @@
1+
---
2+
meta:
3+
title: Setting IAM permissions and implementing RBAC on a cluster
4+
description: This page explains how to set IAM permissions and implement RBAC on a Scaleway Kubernetes cluster
5+
content:
6+
h1: Setting IAM permissions and implementing RBAC on a cluster
7+
paragraph: This page explains how to set IAM permissions and implement RBAC on a Scaleway Kubernetes cluster
8+
tags: kubernetes kapsule-cluser
9+
dates:
10+
validation: 2025-06-02
11+
posted: 2025-06-02
12+
categories:
13+
- kubernetes
14+
---
15+
16+
Role-based access control (RBAC) is a native feature of Kubernetes and a method of regulating access to compute or network resources based on the roles of individual users within your Organization.
17+
The feature is activated on Scaleway Kubernetes Kapsule and Kosmos by default and is compatible with Scaleway's Identity and Access Management (IAM) service.
18+
IAM and RBAC work together by integrating Scaleway’s IAM with Kubernetes' native RBAC system. This integration ensures that access permissions are consistent across both the cloud infrastructure and the Kubernetes cluster, providing a secure access control mechanism.
19+
It allows you to assign roles to users, groups or `ServicesAccount` via `RoleBindings` and `ClusterRoleBindings`.
20+
21+
Key components of RBAC in Kubernetes include:
22+
23+
- **Roles and ClusterRoles:**
24+
- `Roles`: These are specific to a namespace, and define a set of permissions for resources within that namespace (e.g., pods, services).
25+
- `ClusterRoles`: These are similar to roles but apply cluster-wide, spanning all namespaces.
26+
- **RoleBindings and ClusterRoleBindings:**
27+
- `RoleBindings`: These associate a set of permissions defined in a role with a user, group, or service account within a specific namespace.
28+
- `ClusterRoleBindings`: These associate a set of permissions defined in a ClusterRole with a user, group, or service account across the entire cluster.
29+
- **Subjects:** A subject in RBAC can be a user, a group, or a service account to which roles or cluster roles are bound.
30+
- **Rules:** Rules are sets of permissions associated with roles or cluster roles. They specify what actions are allowed or denied on specific resources.
31+
32+
RBAC works seamlessly with Scaleway's IAM (Identity and Access Management) system. [Identity and Access Management (IAM)](/iam/concepts/#iam) provides control over resource access. IAM policies enable the configuration of permissions for Kubernetes Kapsule clusters at the Project level.
33+
34+
An [IAM policy](/iam/concepts/#policy) defines the permissions for users, groups, and applications within an Organization. It consists of a [principal](/iam/concepts/#principal) (the user, group, or application to which it applies) and IAM rules that specify permission sets and their scope.
35+
36+
The combination of IAM and Kubernetes RBAC allows you to define fine-grained access levels for cluster users.
37+
38+
39+
### Mapping IAM permission sets to Kubernetes groups
40+
41+
The following IAM permission sets are mapped to Kubernetes groups:
42+
43+
| IAM permission set | Kubernetes group | Notes |
44+
|----------------------------------|-----------------------------|--------------------------|
45+
| `KubernetesFullAccess` | `scaleway:cluster-write` | |
46+
| | `scaleway:cluster-read` | |
47+
| `KubernetesReadOnly` | `scaleway:cluster-read` | |
48+
| `KubernetesSystemMastersGroupAccess` | `system:masters` | Super-user access to perform any action on any Kubernetes resource, ignoring all RBAC rules |
49+
50+
### Default ClusterRoleBindings
51+
52+
Default `ClusterRoleBinding` and `ClusterRole` configurations have been set up:
53+
54+
| Group | ClusterRoleBinding | ClusterRole |
55+
|----------------------------------|-----------------------------|--------------------------|
56+
| `scaleway:cluster-write` | `scaleway:cluster-write` | `scaleway:cluster-write` |
57+
| `scaleway:cluster-read` | `scaleway:cluster-read` | `scaleway:cluster-read` |
58+
59+
These groups can be edited and will not be reconciled by Kapsule/Kosmos. If these roles are misconfigured and cut off access to the cluster, the IAM permission set `KubernetesSystemMastersGroupAccess` should be assigned to the application or user. This permission set allows bypassing the entire RBAC layer.
60+
61+
Users or applications can be added to zero, one, or more IAM groups. IAM groups are mapped to Kubernetes groups in the format `scaleway:groups:GROUPID`.
62+
63+
**Example:**
64+
65+
```bash
66+
$ kubectl auth whoami
67+
ATTRIBUTE VALUE
68+
Username scaleway:bearer:de60e2b8-d590-4770-94bc-93b639382fb5
69+
UID de60e2b8-d590-4770-94bc-93b639382fb5
70+
Groups [scaleway:group:55eb7ac5-9afe-4e40-8d54-4fbb232cac21 scaleway:cluster-read system:authenticated]
71+
```
72+
73+
## Creating a developers group with write access to dev and staging namespaces
74+
75+
1. Create an [IAM group](/iam/how-to/create-group/) called `developers`:
76+
- Assign the `KubernetesReadOnly` permission set to this group.
77+
- Note the group ID, as it will be needed later.
78+
79+
2. Create namespaces and roles:
80+
As a user or application with `KubernetesFullAccess` or `KubernetesSystemMastersGroupAccess`, create the following manifests:
81+
82+
Namespace creation:
83+
84+
```yaml
85+
apiVersion: v1
86+
kind: Namespace
87+
metadata:
88+
name: dev
89+
---
90+
apiVersion: v1
91+
kind: Namespace
92+
metadata:
93+
name: staging
94+
```
95+
96+
Role creation for dev namespace:
97+
98+
```yaml
99+
apiVersion: rbac.authorization.k8s.io/v1
100+
kind: Role
101+
metadata:
102+
name: developers
103+
namespace: dev
104+
rules:
105+
- apiGroups: ["*"]
106+
resources: ["*"]
107+
verbs: ["*"]
108+
- nonResourceURLs: ["*"]
109+
verbs: ["*"]
110+
```
111+
112+
RoleBinding Creation for dev namespace:
113+
114+
```yaml
115+
apiVersion: rbac.authorization.k8s.io/v1
116+
kind: RoleBinding
117+
metadata:
118+
name: developers
119+
namespace: dev
120+
subjects:
121+
- kind: Group
122+
name: scaleway:groups:<GROUP_ID>
123+
roleRef:
124+
kind: Role
125+
name: developers
126+
apiGroup: rbac.authorization.k8s.io
127+
```
128+
129+
Repeat the same operation for the staging namespace.
130+
131+
3. Apply the manifests:
132+
```bash
133+
kubectl apply -f filename.yaml
134+
```
135+
136+
After these steps, members of the IAM group will have read access to the cluster and write access to the `dev` and `staging` namespaces. Permissions can be refined by modifying the `Role`.
137+
138+
## Assigning permissions to a specific user without using a group
139+
140+
1. Assign the `KubernetesReadOnly` permission set to the user.
141+
2. Retrieve the **IAM user ID** and note it.
142+
3. Create the following manifests:
143+
144+
Namespace creation:
145+
146+
```yaml
147+
apiVersion: v1
148+
kind: Namespace
149+
metadata:
150+
name: demo-sandbox
151+
```
152+
153+
Role creation for an example namespace:
154+
155+
```yaml
156+
apiVersion: rbac.authorization.k8s.io/v1
157+
kind: Role
158+
metadata:
159+
name: example
160+
namespace: example-sandbox
161+
rules:
162+
- apiGroups: ["*"]
163+
resources: ["*"]
164+
verbs: ["*"]
165+
- nonResourceURLs: ["*"]
166+
verbs: ["*"]
167+
```
168+
169+
RoleBinding creation for the example namespace:
170+
171+
```yaml
172+
apiVersion: rbac.authorization.k8s.io/v1
173+
kind: RoleBinding
174+
metadata:
175+
name: example
176+
namespace: example-sandbox
177+
subjects:
178+
- kind: User
179+
name: scaleway:bearer:<USER_ID>
180+
roleRef:
181+
kind: Role
182+
name: demo
183+
apiGroup: rbac.authorization.k8s.io
184+
```
185+
186+
4. Apply the manifests:
187+
188+
```bash
189+
kubectl apply -f filename.yaml
190+
```
191+
192+
The user "demo" now has full rights in the `example-sandbox` namespace.
193+
194+
## Limiting cluster-read access
195+
196+
To modify the `scaleway:cluster-read` permissions, use the following command:
197+
198+
```bash
199+
kubectl edit clusterrole scaleway:cluster-read
200+
```
201+
202+
Default content:
203+
204+
```yaml
205+
apiVersion: rbac.authorization.k8s.io/v1
206+
kind: ClusterRole
207+
metadata:
208+
name: scaleway:cluster-read
209+
rules:
210+
- verbs:
211+
- get
212+
- list
213+
- watch
214+
apiGroups:
215+
- ''
216+
resources:
217+
- bindings
218+
- configmaps
219+
- endpoints
220+
- events
221+
- limitranges
222+
- namespaces
223+
- namespaces/status
224+
- nodes
225+
- persistentvolumeclaims
226+
- persistentvolumeclaims/status
227+
- pods
228+
- pods/log
229+
- pods/status
230+
- replicationcontrollers
231+
- replicationcontrollers/scale
232+
- replicationcontrollers/status
233+
- resourcequotas
234+
- resourcequotas/status
235+
- serviceaccounts
236+
- services
237+
- services/status
238+
239+
240+
- verbs:
241+
- get
242+
- list
243+
- watch
244+
apiGroups:
245+
- metrics.k8s.io
246+
resources:
247+
- pods
248+
- nodes
249+
250+
251+
- verbs:
252+
- get
253+
- list
254+
- watch
255+
apiGroups:
256+
- apps
257+
resources:
258+
- controllerrevisions
259+
- daemonsets
260+
- daemonsets/status
261+
- deployments
262+
- deployments/scale
263+
- deployments/status
264+
- replicasets
265+
- replicasets/scale
266+
- replicasets/status
267+
- statefulsets
268+
- statefulsets/scale
269+
- statefulsets/status
270+
271+
272+
- verbs:
273+
- get
274+
- list
275+
- watch
276+
apiGroups:
277+
- autoscaling
278+
resources:
279+
- horizontalpodautoscalers
280+
- horizontalpodautoscalers/status
281+
282+
283+
- verbs:
284+
- get
285+
- list
286+
- watch
287+
apiGroups:
288+
- batch
289+
resources:
290+
- cronjobs
291+
- cronjobs/status
292+
- jobs
293+
- jobs/status
294+
295+
296+
- verbs:
297+
- get
298+
- list
299+
- watch
300+
apiGroups:
301+
- extensions
302+
resources:
303+
- daemonsets
304+
- daemonsets/status
305+
- deployments
306+
- deployments/scale
307+
- deployments/status
308+
- ingresses
309+
- ingresses/status
310+
- networkpolicies
311+
- replicasets
312+
- replicasets/scale
313+
- replicasets/status
314+
- replicationcontrollers/scale
315+
316+
317+
- verbs:
318+
- get
319+
- list
320+
- watch
321+
apiGroups:
322+
- policy
323+
resources:
324+
- poddisruptionbudgets
325+
- poddisruptionbudgets/status
326+
327+
328+
- verbs:
329+
- get
330+
- list
331+
- watch
332+
apiGroups:
333+
- networking.k8s.io
334+
resources:
335+
- ingresses
336+
- ingresses/status
337+
- networkpolicies
338+
339+
340+
- verbs:
341+
- get
342+
- list
343+
- watch
344+
apiGroups:
345+
- rbac.authorization.k8s.io
346+
resources:
347+
- rolebindings
348+
- roles
349+
```

0 commit comments

Comments
 (0)