chore(docs): update rbac guide for shared cluster #3443

ghost · 2022-12-14T12:54:11Z

What this PR does / why we need it:
RBAC config guide for scoping permissions when there are no dedicated Dev k8s clusters.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

stefreak · 2022-12-14T13:13:46Z

docs/advanced/rbac-config.md

+    ```
+2.  Create an Azure IAM group for the developers who are allowed to deploy to dev namespaces only. Add all the Users to the group and note the group ID.
+
+3. Create a root namespace (`webdev-root` for example) which will have a role that can be inherited by sub-namespaces (all dev namespaces).


maybe we could call it just dev-root? Then its also fine for non-webdev projects

another option could be garden-dev-root

twelvemo

Thanks for writing this up!
I would love this Guide to cover AWS, Azure and GCP and I think it is doable. I made some suggestions around that. What do you think?

twelvemo · 2022-12-14T13:17:45Z

docs/advanced/rbac-config.md

-```
+If there is no dedicated development k8s cluster, the following configurations can be used to limit the permissions, of developers on a shared cluster using RBAC (Role-Based Access Control), to specific dev namespaces only. This can help to ensure that developers have the appropriate access to resources on the shared cluster.
+
+> We have verified to ensure that the following configuration is effective for an Azure IAM group that includes all developers. Similar approach can be followed for any other k8s group mapping. (Contributions, to this doc, are welcome)


I would prefer this guide to cover AWS, Azure and GCP. I think the only places where the configuration differs is the mapping between IAM and Kubernetes RBAC.

Before I go ahead and make changes, I feel we are repeating ourselves especially with this doc.
In my opinion an optimal solution, to make this doc to be valid for all three major* cloud providers, is not keeping it in git book but rather having it as a README in three different example projects (per cloud provider) and having cross reference to that README in the gitbook doc. This way we can also serve with updated config or so. It also makes quite easier to understand when we look at an example than going through the doc. Wdyt?

Sounds like a good idea too. My thinking was that we get the differences covered here and the rest can more or less stay as is. But the example projects are also a good idea, i will leave that to you :-)

twelvemo · 2022-12-14T13:22:47Z

docs/advanced/rbac-config.md

+
+1. Install hierarchical namespace controller in the k8s cluster.
+    ```
+    kubectl apply -f https://github.com/kubernetes-sigs/hierarchical-namespaces/releases/download/v1.0.0/default.yaml


Can we show how to get the latest version of the controller and use that version instead of hardcoding it? Afraid that the version will be outdated pretty soon.

twelvemo · 2022-12-15T11:23:29Z

docs/advanced/rbac-config.md

+    ```
+    kubectl apply -f https://github.com/kubernetes-sigs/hierarchical-namespaces/releases/download/v1.0.0/default.yaml
+    ```
+2.  Create an Azure IAM group for the developers who are allowed to deploy to dev namespaces only. Add all the Users to the group and note the group ID.


Suggested change

2. Create an Azure IAM group for the developers who are allowed to deploy to dev namespaces only. Add all the Users to the group and note the group ID.

2. Next we will need to take care to map your Cloud Provider's IAM groups or users to Kubernetes RBAC. This differs slightly between different cloud providers. The following should give you a brief overview, but might not cover all use cases. Please consider your Cloud Provider's documentation for further info.

For Azure: Create an IAM group for the developers who are allowed to deploy to dev namespaces only. Add all the Users to the group and note the group ID. This group ID can be directly used in `roleBindings` and `clusterRoleBindings`. For more info see [here](https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac).

For AWS: Add your users to the [aws-auth configmap](https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html) and add them to an `apiGroup` that you want to use, we will call it `developers` here. This will be your group ID going forward.

For GCP: You can [create a Google group or add IAM users](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#rolebinding) directly to `roleBindings` and `clusterRoleBindings` We recommend creating a group, as adding single users to several `roleBindings` and `clusterRoleBindings` can become rather tedious.

twelvemo · 2022-12-15T11:34:20Z

docs/advanced/rbac-config.md

+    subjects:
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: <Azure IAM group ID>


Suggested change

name: <Azure IAM group ID>

name: <group created in step 2>

twelvemo · 2022-12-15T11:34:47Z

docs/advanced/rbac-config.md

+    subjects:
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: <Azure IAM group ID>


Suggested change

name: <Azure IAM group ID>

name: <group created in step 2>

twelvemo · 2022-12-15T11:35:26Z

docs/advanced/rbac-config.md

+    subjects:
+    - apiGroup: rbac.authorization.k8s.io
+      kind: Group
+      name: <Azure IAM group ID>


Suggested change

name: <Azure IAM group ID>

name: <group created in step 2>

twelvemo · 2022-12-15T11:42:21Z

docs/advanced/rbac-config.md

+3. Create a root namespace (`webdev-root` for example) which will have a role that can be inherited by sub-namespaces (all dev namespaces).
+
+4. Create a clusterRole and ClusterRoleBinding.
+    ```


Suggested change

```

```

# Allow reading namespaces and persistent volumes, which are cluster-scoped

twelvemo · 2022-12-15T11:44:10Z

docs/advanced/rbac-config.md

+    ```
+
+7. Update project.garden.yaml in order to make sure that sub-namespaces have an annotation (`hnc.x-k8s.io/subnamespace-of: webdev-root` for example) of root namespace where permissions are inherited from.
+    ```


I think providing an example garden project is a great idea, but let's remove the unneeded parts like the local kubernetes env and providers and everything else that is not strictly required here.

eysi09 · 2023-06-14T16:39:34Z

This is pretty old.

Can we resolve the conflicts and get this merged? (cc @twelvemo @srihas-g)

chore(docs): update rbac guide for shared cluster

c25709c

stefreak reviewed Dec 14, 2022

View reviewed changes

twelvemo requested changes Dec 15, 2022

View reviewed changes

ghost marked this pull request as draft March 23, 2023 12:49

vvagaytsev changed the base branch from main to 0.12 May 19, 2023 11:57

vvagaytsev changed the base branch from 0.12 to main May 22, 2023 20:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(docs): update rbac guide for shared cluster #3443

chore(docs): update rbac guide for shared cluster #3443

ghost commented Dec 14, 2022 •

edited by sync-by-unito bot

stefreak Dec 14, 2022

stefreak Dec 14, 2022

twelvemo left a comment

twelvemo Dec 14, 2022

ghost Dec 15, 2022 •

edited by ghost

twelvemo Dec 15, 2022

twelvemo Dec 14, 2022

twelvemo Dec 15, 2022

twelvemo Dec 15, 2022

twelvemo Dec 15, 2022

twelvemo Dec 15, 2022

twelvemo Dec 15, 2022

twelvemo Dec 15, 2022

eysi09 commented Jun 14, 2023

-.  Create an Azure IAM group for the developers who are allowed to deploy to dev namespaces only. Add all the Users to the group and note the group ID.
+. Next we will need to take care to map your Cloud Provider's IAM groups or users to Kubernetes RBAC. This differs slightly between different cloud providers. The following should give you a brief overview, but might not cover all use cases. Please consider your Cloud Provider's documentation for further info.
+For Azure: Create an IAM group for the developers who are allowed to deploy to dev namespaces only. Add all the Users to the group and note the group ID. This group ID can be directly used in `roleBindings` and `clusterRoleBindings`. For more info see [here](https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac).
+For AWS: Add your users to the [aws-auth configmap](https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html) and add them to an `apiGroup` that you want to use, we will call it `developers` here. This will be your group ID going forward.
+For GCP: You can [create a Google group or add IAM users](https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control#rolebinding) directly to `roleBindings` and `clusterRoleBindings` We recommend creating a group, as adding single users to several `roleBindings` and `clusterRoleBindings` can become rather tedious.

	```
	```
	# Allow reading namespaces and persistent volumes, which are cluster-scoped

chore(docs): update rbac guide for shared cluster #3443

Are you sure you want to change the base?

chore(docs): update rbac guide for shared cluster #3443

Conversation

ghost commented Dec 14, 2022 • edited by sync-by-unito bot

Choose a reason for hiding this comment

Choose a reason for hiding this comment

twelvemo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ghost Dec 15, 2022 • edited by ghost

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eysi09 commented Jun 14, 2023

ghost commented Dec 14, 2022 •

edited by sync-by-unito bot

ghost Dec 15, 2022 •

edited by ghost