Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Describe KKP user and admin privileges #1362

Open
csengerszabo opened this issue Feb 14, 2023 · 2 comments
Open

Describe KKP user and admin privileges #1362

csengerszabo opened this issue Feb 14, 2023 · 2 comments
Labels
kind/documentation Categorizes issue or PR as related to documentation. priority/high sig/api Denotes a PR or issue as being assigned to SIG API. sig/security Denotes a PR or issue as being assigned to SIG Security. sig/ui Denotes a PR or issue as being assigned to SIG UI.

Comments

@csengerszabo
Copy link
Contributor

csengerszabo commented Feb 14, 2023

We have to create a clear and appropriate table of the possible actions and privileges of a KKP user and admin somewhere over here in the docs: https://docs.kubermatic.com/kubermatic/main/architecture/role-based-access-control/

@csengerszabo csengerszabo added kind/documentation Categorizes issue or PR as related to documentation. priority/high sig/api Denotes a PR or issue as being assigned to SIG API. sig/security Denotes a PR or issue as being assigned to SIG Security. sig/ui Denotes a PR or issue as being assigned to SIG UI. labels Feb 14, 2023
@embik embik mentioned this issue Feb 16, 2023
@vgramer
Copy link
Contributor

vgramer commented Feb 20, 2023

Just to clarify, This ticket has to explain the difference between a KKP user and KKP admin
(basically same right as an owner on all projects and can edit Kubermatic settings
c.f. https://docs.kubermatic.com/kubermatic/main/tutorials-howtos/administration/admin-panel/)

Rework the existing RBAC to list all possible actions: something like this:

Viewer editor Owner
cluster RO RW RW
cluster nodes (machineDeployment) RO RW RW
addons RO RW RW
project's member X X RW

(to be completed)

@csengerszabo
Copy link
Contributor Author

basically same right as an owner on all projects

Unfortunately this part is currently seem not to be true, and admin privileges are said to be inconsistent. That is why we need to do an anaylsis over what actions the admins can do now exactly. And then the next step would be a proposal to make the privileges of the 2 roles consistent to this basic principle.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/documentation Categorizes issue or PR as related to documentation. priority/high sig/api Denotes a PR or issue as being assigned to SIG API. sig/security Denotes a PR or issue as being assigned to SIG Security. sig/ui Denotes a PR or issue as being assigned to SIG UI.
Projects
None yet
Development

No branches or pull requests

2 participants