Skip to content

Commit f26c3ca

Browse files
bene2k1bene2k1
committed
feat(k8s): iam
1 parent 42a2264 commit f26c3ca

File tree

3 files changed

+128
-179
lines changed

3 files changed

+128
-179
lines changed

‎menu/navigation.json‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1999,6 +1999,10 @@
19991999
"label": "Exposing Kubernetes services to the internet",
20002000
"slug": "exposing-services"
20012001
},
2002+
{
2003+
"label": "Setting IAM permissions and implement RBAC on a cluster",
2004+
"slug": "set-iam-permissions-and-implement-rbac"
2005+
},
20022006
{
20032007
"label": "Modifying kernel parameters in a Kubernetes cluster using a DaemonSet",
20042008
"slug": "modifying-kernel-parameters-kubernetes-cluster"

‎pages/kubernetes/how-to/manage-kubeconfig-with-iam.mdx‎

Lines changed: 0 additions & 60 deletions
This file was deleted.

‎pages/kubernetes/reference-content/set-iam-permissions-and-implement-rbac.mdx‎

Lines changed: 124 additions & 119 deletions
Original file line numberDiff line numberDiff line change
@@ -21,35 +21,40 @@ It allows you to assign roles to users, groups or `ServicesAccount` via `RoleBin
2121
Key components of RBAC in Kubernetes include:
2222

2323
- **Roles and ClusterRoles:**
24-
- **Roles:** These are specific to a namespace and define a set of permissions for resources within that namespace (e.g., pods, services).
25-
- **ClusterRoles:** These are similar to roles but apply cluster-wide, spanning across all namespaces.
24+
- `Roles`: These are specific to a namespace and define a set of permissions for resources within that namespace (e.g., pods, services).
25+
- `ClusterRoles`: These are similar to roles but apply cluster-wide, spanning across all namespaces.
2626
- **RoleBindings and ClusterRoleBindings:**
27-
- **RoleBindings:** These associate a set of permissions defined in a role with a user, group, or service account within a specific namespace.
28-
- **ClusterRoleBindings:** These associate a set of permissions defined in a ClusterRole with a user, group, or service account across the entire cluster.
27+
- `RoleBindings`: These associate a set of permissions defined in a role with a user, group, or service account within a specific namespace.
28+
- `ClusterRoleBindings`: These associate a set of permissions defined in a ClusterRole with a user, group, or service account across the entire cluster.
2929
- **Subjects:** A subject in RBAC can be a user, a group, or a service account to which roles or cluster roles are bound.
3030
- **Rules:** Rules are sets of permissions associated with roles or cluster roles. They specify what actions are allowed or denied on specific resources.
3131

32-
RBAC works seamlessly with Scaleway's IAM (Identity and Access Maanagement) system. Refer to [How to manage Kubeconfig files with IAM](/containers/kubernetes/how-to/manage-kubeconfig-with-iam/) for information how to configure IAM permissions for your users.
32+
RBAC works seamlessly with Scaleway's IAM (Identity and Access Maanagement) system. [Identity and Access Management (IAM)](/iam/concepts/#iam) provides control over resource access. IAM policies enable the configuration of permissions for Kubernetes Kapsule clusters at the Project level.
33+
34+
An [IAM policy](/iam/concepts/#policy) defines the permissions for users, groups, and applications within an Organization. It consists of a [principal](/iam/concepts/#principal) (the user, group, or application to which it applies) and IAM rules that specify permission sets and their scope.
35+
36+
The combination of IAM and Kubernetes RBAC allows you to define fine-grained access levels for cluster users.
37+
3338

3439
### Mapping IAM permission sets to Kubernetes groups
3540

3641
The following IAM permission sets are mapped to Kubernetes groups:
3742

3843
| IAM Permission Set | Kubernetes Group | Notes |
3944
|----------------------------------|-----------------------------|--------------------------|
40-
| KubernetesFullAccess | scaleway:cluster-write | |
41-
| | scaleway:cluster-read | |
42-
| KubernetesReadOnly | scaleway:cluster-read | |
43-
| KubernetesSystemMastersGroupAccess | system:masters | God mode |
45+
| `KubernetesFullAccess` | `scaleway:cluster-write` | |
46+
| | `scaleway:cluster-read` | |
47+
| `KubernetesReadOnly` | `scaleway:cluster-read` | |
48+
| `KubernetesSystemMastersGroupAccess` | `system:masters` | God mode |
4449

4550
### Default ClusterRoleBindings
4651

4752
Default `ClusterRoleBinding` and `ClusterRole` configurations have been set up:
4853

4954
| Group | ClusterRoleBinding | ClusterRole |
5055
|----------------------------------|-----------------------------|--------------------------|
51-
| scaleway:cluster-write | scaleway:cluster-write | scaleway:cluster-write |
52-
| scaleway:cluster-read | scaleway:cluster-read | scaleway:cluster-read |
56+
| `scaleway:cluster-write` | `scaleway:cluster-write` | `scaleway:cluster-write` |
57+
| `scaleway:cluster-read` | `scaleway:cluster-read` | `scaleway:cluster-read` |
5358

5459
These groups can be edited and will not be reconciled by Kapsule/Kosmos. If these roles are misconfigured and cut off access to the cluster, the IAM permission set `KubernetesSystemMastersGroupAccess` should be assigned to the application or user. This permission set allows bypassing the entire RBAC layer.
5560

@@ -60,134 +65,134 @@ Users or applications can be added to zero, one, or more IAM groups. IAM groups
6065
```bash
6166
$ kubectl auth whoami
6267
ATTRIBUTE VALUE
63-
Username scaleway:bearer:dea0a399-af6e-4e8b-b2dd-32c9a26a174b
64-
UID dea0a399-af6e-4e8b-b2dd-32c9a26a174b
65-
Groups [scaleway:group:d4f154d6-a93c-4bab-a599-5f3803bd5120 scaleway:cluster-read system:authenticated]
68+
Username scaleway:bearer:de60e2b8-d590-4770-94bc-93b639382fb5
69+
UID de60e2b8-d590-4770-94bc-93b639382fb5
70+
Groups [scaleway:group:55eb7ac5-9afe-4e40-8d54-4fbb232cac21 scaleway:cluster-read system:authenticated]
6671
```
6772

6873
## Creating a developers group with write access to dev and staging namespaces
6974

70-
1. Create an IAM developers group:
75+
1. Create an [IAM group](/iam/how-to/create-group/) called `developers`:
7176
- Assign the `KubernetesReadOnly` permission set to this group.
7277
- Note the group ID, as it will be needed later.
7378

74-
2. Create Namespaces and Roles:
75-
- As a user/app with `KubernetesFullAccess` or `KubernetesSystemMastersGroupAccess`, create the following manifests:
76-
77-
Namespace Creation:
78-
79-
```yaml
80-
apiVersion: v1
81-
kind: Namespace
82-
metadata:
83-
name: dev
84-
---
85-
apiVersion: v1
86-
kind: Namespace
87-
metadata:
88-
name: staging
89-
```
90-
91-
Role Creation for dev namespace:
92-
93-
```yaml
94-
apiVersion: rbac.authorization.k8s.io/v1
95-
kind: Role
96-
metadata:
97-
name: developers
98-
namespace: dev
99-
rules:
100-
- apiGroups: ["*"]
101-
resources: ["*"]
102-
verbs: ["*"]
103-
- nonResourceURLs: ["*"]
104-
verbs: ["*"]
105-
```
106-
107-
RoleBinding Creation for dev namespace:
108-
109-
```yaml
110-
apiVersion: rbac.authorization.k8s.io/v1
111-
kind: RoleBinding
112-
metadata:
113-
name: developers
114-
namespace: dev
115-
subjects:
116-
- kind: Group
117-
name: scaleway:groups:<GROUP_ID>
118-
roleRef:
119-
kind: Role
120-
name: developers
121-
apiGroup: rbac.authorization.k8s.io
122-
```
123-
124-
Repeat the same operation for the staging namespace.
79+
2. Create namespaces and roles:
80+
As a user/app with `KubernetesFullAccess` or `KubernetesSystemMastersGroupAccess`, create the following manifests:
81+
82+
Namespace creation:
83+
84+
```yaml
85+
apiVersion: v1
86+
kind: Namespace
87+
metadata:
88+
name: dev
89+
---
90+
apiVersion: v1
91+
kind: Namespace
92+
metadata:
93+
name: staging
94+
```
95+
96+
Role creation for dev namespace:
97+
98+
```yaml
99+
apiVersion: rbac.authorization.k8s.io/v1
100+
kind: Role
101+
metadata:
102+
name: developers
103+
namespace: dev
104+
rules:
105+
- apiGroups: ["*"]
106+
resources: ["*"]
107+
verbs: ["*"]
108+
- nonResourceURLs: ["*"]
109+
verbs: ["*"]
110+
```
111+
112+
RoleBinding Creation for dev namespace:
113+
114+
```yaml
115+
apiVersion: rbac.authorization.k8s.io/v1
116+
kind: RoleBinding
117+
metadata:
118+
name: developers
119+
namespace: dev
120+
subjects:
121+
- kind: Group
122+
name: scaleway:groups:<GROUP_ID>
123+
roleRef:
124+
kind: Role
125+
name: developers
126+
apiGroup: rbac.authorization.k8s.io
127+
```
128+
129+
Repeat the same operation for the staging namespace.
125130
126131
3. Apply the Manifests:
127132
128-
```bash
129-
kubectl apply -f filename.yaml
130-
```
133+
```bash
134+
kubectl apply -f filename.yaml
135+
```
131136

132137
After these steps, members of the IAM group will have read access to the cluster and write access to the `dev` and `staging` namespaces. Permissions can be refined by modifying the `Role`.
133138

134139
## Assigning permissions to a specific user without using a group
135140

136-
1. **Assign the `KubernetesReadOnly` Permission Set to the User**.
137-
2. **Retrieve the IAM User ID** and note it.
138-
3. **Create the Following Manifests**:
139-
140-
Namespace creation:
141-
142-
```yaml
143-
apiVersion: v1
144-
kind: Namespace
145-
metadata:
146-
name: demo-sandbox
147-
```
148-
149-
Role creation for an example namespace:
150-
151-
```yaml
152-
apiVersion: rbac.authorization.k8s.io/v1
153-
kind: Role
154-
metadata:
155-
name: example
156-
namespace: example-sandbox
157-
rules:
158-
- apiGroups: ["*"]
159-
resources: ["*"]
160-
verbs: ["*"]
161-
- nonResourceURLs: ["*"]
162-
verbs: ["*"]
163-
```
164-
165-
RoleBinding creation for the example namespace:
166-
167-
```yaml
168-
apiVersion: rbac.authorization.k8s.io/v1
169-
kind: RoleBinding
170-
metadata:
171-
name: example
172-
namespace: example-sandbox
173-
subjects:
174-
- kind: User
175-
name: scaleway:bearer:<USER_ID>
176-
roleRef:
177-
kind: Role
178-
name: demo
179-
apiGroup: rbac.authorization.k8s.io
180-
```
141+
1. Assign the `KubernetesReadOnly` Permission Set to the User.
142+
2. Retrieve the **IAM user ID** and note it.
143+
3. Create the following Manifests:
144+
145+
Namespace creation:
146+
147+
```yaml
148+
apiVersion: v1
149+
kind: Namespace
150+
metadata:
151+
name: demo-sandbox
152+
```
153+
154+
Role creation for an example namespace:
155+
156+
```yaml
157+
apiVersion: rbac.authorization.k8s.io/v1
158+
kind: Role
159+
metadata:
160+
name: example
161+
namespace: example-sandbox
162+
rules:
163+
- apiGroups: ["*"]
164+
resources: ["*"]
165+
verbs: ["*"]
166+
- nonResourceURLs: ["*"]
167+
verbs: ["*"]
168+
```
169+
170+
RoleBinding creation for the example namespace:
171+
172+
```yaml
173+
apiVersion: rbac.authorization.k8s.io/v1
174+
kind: RoleBinding
175+
metadata:
176+
name: example
177+
namespace: example-sandbox
178+
subjects:
179+
- kind: User
180+
name: scaleway:bearer:<USER_ID>
181+
roleRef:
182+
kind: Role
183+
name: demo
184+
apiGroup: rbac.authorization.k8s.io
185+
```
181186
182187
4. Apply the manifests:
183188
184-
```bash
185-
kubectl apply -f filename.yaml
186-
```
189+
```bash
190+
kubectl apply -f filename.yaml
191+
```
187192

188-
User "demo" now has full rights in the `example-sandbox` namespace.
193+
The user "demo" now has full rights in the `example-sandbox` namespace.
189194

190-
## Limiting `cluster-read` Access
195+
## Limiting cluster-read Access
191196

192197
To modify the `scaleway:cluster-read` permissions, use the following command:
193198

0 commit comments

Comments
 (0)