Authentication and authorization

The module provides authentication and authorization via Kubernetes tokens and RBAC based on the PayloadRepositoryAccess resource.

Authentication with Kubernetes tokens

In this authentication mode, the following parameters are used:

• Username: token
• Password: Kubernetes bearer token (from a projected volume, d8 k create token, or obtained via the kubeconfig generation interface (ID Token))

Access to repository paths is determined by Kubernetes RBAC rules for the PayloadRepositoryAccess resource.

RBAC and PayloadRepositoryAccess

When authenticating with a Kubernetes token, access to repository paths is controlled using Kubernetes RBAC applied to the virtual resource PayloadRepositoryAccess:

• API group: payload-registry.deckhouse.io
• Resource name: payloadrepositoryaccesses (PayloadRepositoryAccess)
• Purpose: A virtual resource used only for configuring access to the registry via Kubernetes RBAC.

PayloadRepositoryAccess objects are not created in Kubernetes; they are used to grant permissions through Role or ClusterRole on this resource, for the registry and Kubernetes API extension to check access to repository paths and tags.

The resourceNames field defines repository path patterns.

Possible pattern substitutions:

If the requested path matches the allowed resourceNames (or when resourceNames is absent) and the access level (verb) matches, access is granted.

Access levels (verbs)

Example RBAC configuration

The following is an example of granting a ServiceAccount full access (including getting and deleting tags via the Kubernetes API extension) to repositories in namespace project-1:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: payload-registry-full
  namespace: project-1
rules:
- apiGroups: ["payload-registry.deckhouse.io"]
  resources: ["payloadrepositoryaccesses"]
  resourceNames: 
    - "dist/*"
    - "app/**"
  verbs: ["get", "list", "create", "delete"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: payload-registry-read
  namespace: project-1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: payload-registry-full
subjects:
- kind: ServiceAccount
  name: payload-registry-sa
  namespace: project-1

Authorizing with a token and pushing an image to the registry

To authorize in the container registry using a token, follow these steps:

1. Create a namespace to which registry images will be bound:

   d8 k create namespace project-1

2. Authorization in registry using a ServiceAccount token:

   1. Create a Role in that namespace defining access (see example above).

   2. Create a ServiceAccount:

      d8 k -n project-1 create serviceaccount payload-registry-sa

   3. Bind it to the Role with a RoleBinding (see example above).

   4. Log in to payload-registry from your machine:

        docker login payload-registry.${PUBLIC_DOMAIN} -u token --password $(d8 k -n project-1 create token payload-registry-sa)

3. Authorization in the registry using a token obtained through the kubeconfig generation interface (ID Token):

   1. Bind the user to the Role or ClusterRole with a RoleBinding or ClusterRoleBinding respectively (see example above).

   2. Copy the ID Token from the kubeconfig page.

   3. Log in to the registry from your machine:

      docker login payload-registry.${PUBLIC_DOMAIN} -u token -p <ID Token>

4. Create an image and assign it a tag:

   docker tag ubuntu:latest payload-registry.${PUBLIC_DOMAIN}/project-1/dist/ubuntu:latest

5. Push the image to the registry:

   docker push payload-registry.${PUBLIC_DOMAIN}/project-1/dist/ubuntu:latest

6. Verify the presence of the image in the registry. Example using the crane command:

   crane catalog payload-registry.${PUBLIC_DOMAIN}