⚠️ Warning: This repository has been moved to AthenZ/garm.
This repository is submitted to Athenz Open-Source Community. All ongoing developments and maintenances will continue in the new repository.
# update your local clone
git remote set-url origin https://github.com/AthenZ/garm.git
Garm implements the Kubernetes authorization webhook interface to provide access control on your K8s resources with Athenz RBAC policy. It allows flexible resource mapping from K8s resources to Athenz ones, mutli-tenancy, and black/white list.
By default, Garm replies the native Kubernetes authentication for authorization. However, it also supports the Kubernetes authentication webhook. Using the authentication hook requires Athenz to be able to sign tokens for users.
Requires go 1.14 or later.
- K8s webhook request (SubjectAccessReview) (Webhook Mode - Kubernetes)
- the K8s API server wants to know if the user is allowed to do the requested action
- Athenz RBAC request (Athenz)
- Athenz server contains the user authorization information for access control
- ask Athenz server is the user action is allowed based on pre-configured policy
Garm convert the K8s request to Athenz request based on the mapping rules in config.yaml (example).
P.S. It is just a sample deployment solution above. Garm can work on any environment as long as it can access both the API server and the Athenz server.
$ docker pull yahoojapan/garm- Authentication support for Garm
- Helm Support
- mTLS Support between Athenz and Garm
- multi Athenz domain support
Copyright (C) 2018 Yahoo Japan Corporation Athenz team.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
This project requires contributors to agree to a Contributor License Agreement (CLA).
Note that only for contributions to the garm repository on the GitHub, the contributors of them shall be deemed to have agreed to the CLA without individual written agreements.
- Releases