To grant permissions in Deckhouse Kubernetes Platform (DKP), you need to define a subjects block in custom resources.
For users, it should be specified in the following format:
subjects:
- kind: User
name: <user email>
If you are using the user-authn module and static users, make sure to specify the user’s email in subjects,
not the name of the User resource.
Alternatively, you can grant permissions by group:
subjects:
- kind: Group
name: <name of the group the user belongs to>
For a service account, the subjects block should be specified as follows:
subjects:
- kind: ServiceAccount
name: <service account name>
namespace: <namespace where the service account is created>
Granting permissions using AuthorizationRule and ClusterAuthorizationRule (current role model)
When using the current role model in DKP, you can grant permissions to users via the AuthorizationRule and ClusterAuthorizationRule resources.
Granting permissions to a user within a single namespace
To grant a user permissions within a single namespace, use the AuthorizationRule resource. It is applied within a single namespace.
Example:
apiVersion: deckhouse.io/v1
kind: AuthorizationRule
metadata:
name: dev-access
namespace: dev-namespace
spec:
subjects:
- kind: User
name: dev-user@example.com
accessLevel: Admin
portForwarding: true
Granting permissions to a user in all namespaces
To grant a user permissions across all namespaces, including system ones (for example, to assign administrator permissions), use the ClusterAuthorizationRule resource. It is applied cluster-wide.
If needed, you can restrict the scope of permissions granted via ClusterAuthorizationRule to one or several namespaces. To do this, you can set the corresponding restrictions in the manifest. However, if possible, it is recommended that you use the AuthorizationRule resource for this purpose.
Example:
apiVersion: deckhouse.io/v1
kind: ClusterAuthorizationRule
metadata:
name: admin-access
spec:
subjects:
- kind: User
name: dev-user@example.com
# Available only with enableMultiTenancy mode turned on
# in the user-authz module (Enterprise Edition).
namespaceSelector:
labelSelector:
matchLabels:
env: review
accessLevel: SuperAdmin
portForwarding: true
Granting permissions using ClusterRoleBinding and RoleBinding (experimental role model)
When using the experimental role model in DKP, you can grant permissions to users via the ClusterRoleBinding and RoleBinding resources.
Assigning cluster administrator permissions (experimental role model)
To assign cluster administrator permissions, use the manage role d8:manage:all:manager in a ClusterRoleBinding resource.
Example of assigning cluster administrator permissions to the user joe:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cluster-admin-joe
subjects:
- kind: User
name: joe
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: d8:manage:all:manager
apiGroup: rbac.authorization.k8s.io
Assigning networking administrator permissions (experimental role model)
To assign networking administrator permissions for managing the cluster’s networking subsystem,
use the manage role d8:manage:networking:manager in a ClusterRoleBinding resource.
Example of assigning networking administrator permissions to the user joe:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: network-admin-joe
subjects:
- kind: User
name: joe
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: d8:manage:networking:manager
apiGroup: rbac.authorization.k8s.io
Granting administrator permissions to a user within a namespace (experimental role model)
To assign or restrict user permissions to specific namespaces, apply a use role with the corresponding access level in a RoleBinding resource.
For example, to allow a user to manage application resources in a namespace (without giving them access to DKP module configurations), use the d8:use:role:admin role in a RoleBinding resource for the corresponding namespace.
Example of granting application developer app-developer permissions within the myapp namespace:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: myapp-developer
namespace: myapp
subjects:
- kind: User
name: app-developer
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: d8:use:role:admin
apiGroup: rbac.authorization.k8s.io