The user-authz module: Custom Resources

This object manages RBAC and namespace-based authorization.

The settings determine which access level is assigned to the user and/or group.

The ClusterAuthorizationRule resource belongs to the basic role-based model. Its permissions add up with those of the granular model.

• status

  object

  Observed state of the rule, maintained by user-authz-controller.

  • status.bindings

    integer

    Number of bindings rendered for the rule.

  • status.conditions

    array of objects

    Conditions of the rule. Ready=True means every binding of the rule is applied; Ready=False with reason InvalidSpec means the rule cannot be rendered and no binding was changed, with reason ApplyError that the API server rejected a write (the message names the binding and the error).

    • status.conditions.lastTransitionTime

      string

      Time of the last change of the condition status.

    • status.conditions.message

      string

      Details of the status.

    • status.conditions.observedGeneration

      integer

      Generation of the rule that the condition refers to.

    • status.conditions.reason

      string

      Reason of the status, BindingsApplied, InvalidSpec or ApplyError.

    • status.conditions.status

      string

      Required value

      Condition status.

      Allowed values: True, False, Unknown

    • status.conditions.type

      string

      Required value

      Condition type. The controller sets Ready.

  • status.observedGeneration

    integer

    Generation of the rule the status refers to.

• spec

  object

  Required value

  • spec.accessLevel

    string

    Access level:

    • User — has access to information about all objects (including viewing pod logs) but cannot exec into containers, read secrets, and perform port-forwarding;
    • PrivilegedUser — the same as User + can exec into containers, read secrets, and delete pods (and thus, restart them);
    • Editor — the same as PrivilegedUser + can create, edit, and delete the objects that are usually required for application tasks;
    • Admin — the same as Editor + can create and modify pods, create ServiceAccount tokens (serviceaccounts/token), manage Role, RoleBinding, and AuthorizationRule objects, and delete auxiliary objects (for example, ReplicaSet and the challenges and orders of the acme.cert-manager.io group);
    • ClusterEditor — the same as Editor + can manage a limited set of cluster-wide objects used in application tasks (DaemonSet, StorageClass, CustomResourceDefinition, GatewayClass, and the objects that modules add at this level, for example, KeepalivedInstance). This role is best suited for cluster operators.

    • ClusterAdmin — the same as both ClusterEditor and Admin + can manage cluster-wide service objects (namespaces, quotas, NetworkPolicy, the proxy subresources of nodes, ClusterAuthorizationRule, ClusterRole, and ClusterRoleBinding). This role is best suited for cluster administrators.

      Warning. ClusterAdmin can create ClusterAuthorizationRule objects only up to the ClusterAdmin level, and ClusterRoleBinding objects only to roles whose permissions it already holds.

    • SuperAdmin — can perform any actions with any objects (note that limitNamespaces and namespaceSelector (see below) restrictions remain valid).

    Allowed values: User, PrivilegedUser, Editor, Admin, ClusterEditor, ClusterAdmin, SuperAdmin

    Example:

    accessLevel: PrivilegedUser
    

  • spec.additionalRoles

    array of objects

    Additional roles to bind for subjects.

    Use the accessLevel parameter instead; this parameter is for exceptional cases.

    Example:

    additionalRoles:
    - apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: cluster-admin
    

    • spec.additionalRoles.apiGroup

      string

      Required value

      API group of the role. Only rbac.authorization.k8s.io is supported.

      Example:

      apiGroup: rbac.authorization.k8s.io
      

    • spec.additionalRoles.kind

      string

      Required value

      Kind of the role.

      Allowed values: ClusterRole

      Example:

      kind: ClusterRole
      

    • spec.additionalRoles.name

      string

      Required value

      Name of the role.

      Example:

      name: cluster-admin
      

  • spec.allowAccessToSystemNamespaces

    Deprecated

    boolean

    Available in editions: BE, SE, SE+, Ultimate/EE

    Allow access to system namespaces (kube-*, d8-*, default, antiopa, loghouse).

    Requires the enableMultiTenancy parameter. While it is disabled, a rule with this field is refused, and a rule that already has it is applied without its namespace limits, in every namespace of the cluster.

    The namespace limits of the rule are enforced by the authorization webhook, so they do not apply to the subjects that the webhook does not check: control plane components, kubelets, and the ServiceAccounts of kube-system and of the namespaces whose names start with d8-. For them, the access level of the rule applies in every namespace.

    Deprecated. Use the namespaceSelector field instead.

    Default: false

  • spec.allowScale

    boolean

    Defines if scaling of Deployments and StatefulSets is allowed/not allowed.

    Default: false

  • spec.limitNamespaces

    Deprecated

    array of strings

    Available in editions: BE, SE, SE+, Ultimate/EE

    List of regex-patterns that define namespaces accessible by the user.

    Each pattern must match the whole namespace name: team does not match team-2. A pattern that is not a valid RE2 regular expression is refused when the rule is written. If the check misses it, the pattern is ignored, the rule opens fewer namespaces, and the D8UserAuthzWebhookRulesQuarantined alert fires.

    The decision making process:

    • If the list is defined, then only its constituents are accessible.
    • If the list is not defined, then all namespaces are accessible (except for the system ones, see the allowAccessToSystemNamespaces field).

    Requires the enableMultiTenancy parameter. While it is disabled, a rule with this field is refused, and a rule that already has it is applied without its namespace limits, in every namespace of the cluster.

    The namespace limits of the rule are enforced by the authorization webhook, so they do not apply to the subjects that the webhook does not check: control plane components, kubelets, and the ServiceAccounts of kube-system and of the namespaces whose names start with d8-. For them, the access level of the rule applies in every namespace.

    Deprecated. Use the namespaceSelector field instead.

    Example:

    limitNamespaces: production-.*
    

    • Element of the array

      string
  • spec.namespaceSelector

    object

    Available in editions: BE, SE, SE+, Ultimate/EE

    Defines a set of namespaces accessible by the user, using the value of the namespaceSelector.labelSelector parameter.

    If the namespaceSelector parameter is specified, the values of the limitNamespaces and allowAccessToSystemNamespaces parameters are ignored. If the namespaceSelector.matchAny field is specified, then all namespaces (including system namespaces) will be accessible. Otherwise, only the namespaces with labels matching the namespaceSelector.labelSelector conditions will be accessible (including system namespaces).

    If the namespaceSelector parameter is not specified, then the set of available namespaces is determined by the value of the limitNamespaces and allowAccessToSystemNamespaces parameters. If none of the parameters namespaceSelector, limitNamespaces and allowAccessToSystemNamespaces are specified, then all namespaces will be available, except for the system ones (kube-*, d8-*, default, antiopa, loghouse).

    Requires the enableMultiTenancy parameter. While it is disabled, a rule with this field is refused, and a rule that already has it is applied without its namespace limits, in every namespace of the cluster.

    The namespace limits of the rule are enforced by the authorization webhook, so they do not apply to the subjects that the webhook does not check: control plane components, kubelets, and the ServiceAccounts of kube-system and of the namespaces whose names start with d8-. For them, the access level of the rule applies in every namespace.

    • spec.namespaceSelector.labelSelector

      object

      Defines the label selector-based filter of the namespaces.

      Cannot be used together with the matchAny parameter.

      If both matchExpressions and matchLabels parameters are set, their requirements are ANDed together — they must all be satisfied in order to match. If multiple matchExpression conditions are provided, they all must be satisfied in order to match.

      • spec.namespaceSelector.labelSelector.matchExpressions

        array of objects

        An array of set-based expressions.

        Example:

        matchExpressions:
        - key: tier
          operator: In
          values:
          - production
          - staging
        - key: tier
          operator: NotIn
          values:
          - production
        

        • spec.namespaceSelector.labelSelector.matchExpressions.key

          string

          A label name.

        • spec.namespaceSelector.labelSelector.matchExpressions.operator

          string

          A comparison operator.

          Allowed values: In, NotIn, Exists, DoesNotExist

        • spec.namespaceSelector.labelSelector.matchExpressions.values

          array of strings

          A label value.

          • Element of the array

            string

            Pattern: [a-z0-9]([-a-z0-9]*[a-z0-9])?

            Length: 1..63

      • spec.namespaceSelector.labelSelector.matchLabels

        object

        A set of labels a namespace must have to match.

        Example:

        matchLabels:
          foo: bar
          baz: who
        

    • spec.namespaceSelector.matchAny

      boolean

      Unconditionally permits access to any namespace in the cluster, including system namespaces.

      Cannot be used together with the labelSelector parameter.

      Since labelSelector provides access to a limited number of the namespaces that match it, matchAny is needed in cases where access to all namespaces is to be granted.

      Allowed values: true

  • spec.portForwarding

    boolean

    Allow/disallow the user to do port-forwarding.

    Default: false

  • spec.subjects

    array of objects

    Required value

    Users, groups, and ServiceAccounts to grant the access level to.

    Kubernetes API reference

    Pay attention to the following nuances if this module is used together with the user-authn module:

    • Use the user’s email as the username to grant privileges to the specific user;
    • When specifying a group, make sure that the necessary groups are allowed to be received from the provider, i.e., they are defined in the corresponding custom resource DexProvider.
    • spec.subjects.kind

      string

      Required value

      Type of user identification resource.

      Allowed values: User, Group, ServiceAccount

      Example:

      kind: Group
      

    • spec.subjects.name

      string

      Required value

      Resource name.

      Example:

      name: some-group-name
      

    • spec.subjects.namespace

      string

      ServiceAccount namespace. The namespace limits of the rule do not apply to the ServiceAccounts of kube-system and of the namespaces whose names start with d8-: the authorization webhook does not check them.

      Pattern: [a-z0-9]([-a-z0-9]*[a-z0-9])?

      Length: 1..63