The user-authz module: Custom Resources

This object manages RBAC and namespace-based authorization.

• specobject

  Required value

  • spec.accessLevelstring

    Access level:

    • User — has access to information about all objects (including viewing pod logs) but cannot exec into containers, read secrets, and perform port-forwarding;
    • PrivilegedUser — the same as User + can exec into containers, read secrets, and delete pods (and thus, restart them);
    • Editor — is the same as PrivilegedUser + can create and edit all objects that are usually required for application tasks;
    • Admin — the same as Editor + can delete service objects (auxiliary resources such as ReplicaSet, certmanager.k8s.io/challenges and certmanager.k8s.io/orders);
    • ClusterEditor — the same as Editor + can manage a limited set of cluster-wide objects that can be used in application tasks (ClusterXXXMetric, KeepalivedInstance, DaemonSet, etc.). This role is best suited for cluster operators.

    • ClusterAdmin — the same as both ClusterEditor and Admin + can manage cluster-wide service objects (e.g., MachineSets, Machines, OpenstackInstanceClasses…, as well as ClusterAuthorizationRule, ClusterRoleBindings and ClusterRole). This role is best suited for cluster administrators.

      Caution! since ClusterAdmin can edit ClusterRoleBindings, he can broader his privileges within the cluster;

    • SuperAdmin — can perform any actions with any objects (note that limitNamespaces and namespaceSelector (see below) restrictions remain valid).

    Allowed values: User, PrivilegedUser, Editor, Admin, ClusterEditor, ClusterAdmin, SuperAdmin

    Example:

    accessLevel: PrivilegedUser
    

  • spec.additionalRolesarray of objects

    Additional roles to bind for subjects.

    This parameter is reserved for emergencies. Please, use the accessLevel parameter instead.

    Example:

    additionalRoles:
    - apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-write-all
    - apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-read-all
    

    • spec.additionalRoles.apiGroupstring

      Required value

      apiGroup for users.

      Example:

      apiGroup: rbac.authorization.k8s.io
      

    • spec.additionalRoles.kindstring

      Required value

      Kind of the role.

      Allowed values: ClusterRole

      Example:

      kind: ClusterRole
      

    • spec.additionalRoles.namestring

      Required value

      Name of the role.

      Example:

      name: cluster-admin
      

  • spec.allowAccessToSystemNamespacesDeprecatedboolean

    Allow access to System namespaces (kube-, d8-, loghouse, default).

    Option available only if the enableMultiTenancy option is enabled.

    Deprecated. Use the namespaceSelector field instead.

    Default: false

    This feature is available in enterprise edition only.

  • spec.allowScaleboolean

    Defines if scaling of Deployments and StatefulSets is allowed/not allowed.

    Default: false

  • spec.limitNamespacesDeprecatedarray of strings

    List of regex-patterns that define namespaces accessible by the user.

    The decision making process:

    • If the list is defined, then only its constituents are accessible.
    • If the list is not defined, then all namespaces are accessible (except for the system ones - see spec.allowAccessToSystemNamespaces below).

    Option available only if enableMultiTenancy option is enabled.

    Deprecated. Use the namespaceSelector field instead.

    This feature is available in enterprise edition only.

    Example:

    limitNamespaces:
    - production-.*
    

    • Element of the arraystring
  • spec.namespaceSelectorobject

    Defines a set of namespaces accessible by the user, using the value of the namespaceSelector.labelSelector parameter.

    If the parameter namespaceSelector is specified, the values of the parameters limitNamespaces and allowAccessToSystemNamespaces are ignored. Thus, all namespaces with labels that fall under the conditions specified in the namespace Selector.labelSelector parameter, including system namespaces, will be available.

    If the namespaceSelector parameter is not specified, then the set of available namespaces is determined by the value of the limitNamespaces and allowAccessToSystemNamespaces parameters. If none of the parameters namespaceSelector, limitNamespaces and allowAccessToSystemNamespaces are specified, then all namespaces will be available, except for the system ones (kube-*, d8-*, loghouse, default).

    Is available only if the enableMultiTenancy parameter is enabled.

    • spec.namespaceSelector.labelSelectorobject

      Required value

      Defines label selector-based filter of namespaces.

      If both matchExpressions and matchLabels parameters are set, their requirements are ANDed together — they must all be satisfied in order to match.

      • spec.namespaceSelector.labelSelector.matchExpressionsarray of objects

        An array of set-based expressions.

        • spec.namespaceSelector.labelSelector.matchExpressions.keystring

          Required value

          A label name.

        • spec.namespaceSelector.labelSelector.matchExpressions.operatorstring

          Required value

          A comparison operator.

          Allowed values: In, NotIn, Exists, DoesNotExist

        • spec.namespaceSelector.labelSelector.matchExpressions.valuesarray of strings

          A label value.

          • Element of the arraystring

            Pattern: [a-z0-9]([-a-z0-9]*[a-z0-9])?

            Length: 1..63

      • spec.namespaceSelector.labelSelector.matchLabelsobject

        A set of labels a namespace must have to match.

        Example:

        matchLabels:
          foo: bar
          baz: who
        

  • spec.portForwardingboolean

    Allow/disallow the user to do port-forwarding.

    Default: false

  • spec.subjectsarray of objects

    Required value

    Users and/or groups to grant privileges.

    Kubernetes API reference…

    Pay attention to the following nuances if this module is used together with the user-authn module:

    • Use the user’s email as the username to grant privileges to the specific user;
    • When specifying a group, make sure that the necessary groups are allowed to be received from the provider, i.e., they are defined in the corresponding custom resource DexProvider.
    • spec.subjects.kindstring

      Required value

      Type of user identification resource.

      Allowed values: User, Group, ServiceAccount

      Example:

      kind: Group
      

    • spec.subjects.namestring

      Required value

      Resource name.

      Example:

      name: some-group-name
      

    • spec.subjects.namespacestring

      ServiceAccount namespace.

      Pattern: [a-z0-9]([-a-z0-9]*[a-z0-9])?

      Length: 1..63