-
Notifications
You must be signed in to change notification settings - Fork 16
STAC-22208: document RBAC on Rancher #1621
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
fvlankvelt
wants to merge
6
commits into
suse-observability-staging
Choose a base branch
from
STAC-22208-document-rbac-in-rancher
base: suse-observability-staging
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
a2e2401
STAC-22208: document RBAC on Rancher
fvlankvelt f62f9d0
STAC-22208: fix links
fvlankvelt 9ffb065
STAC-22208: format table
fvlankvelt 3f24058
STAC-22208: fix tyop in rancher oidc auth
fvlankvelt 2ca06a5
STAC-22208: add section on system:authenticated
fvlankvelt 95f4209
STAC-22208: make separation between standalone & rancher RBAC clearer
fvlankvelt File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,175 @@ | ||
| --- | ||
fvlankvelt marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| description: SUSE Observability Self-hosted | ||
| --- | ||
|
|
||
| ## Overview | ||
|
|
||
| The SUSE Rancher Prime Observability Extension uses Kubernetes RBAC to grant access to Rancher users in SUSE Observability. | ||
| If you do not use Rancher, look at [How to set up roles](rbac_roles.md) in a standalone installation. | ||
|
|
||
| Two kinds of roles are used for accessing SUSE Observability: | ||
| * A *scope role* (Observer) grants access to data - either all data in a SUSE Observability instance, data coming from a cluster, or just the data for a namespace. This role is provisioned in a cluster to be observed. | ||
| * An *instance role* grants permissions to access or modify functionality of SUSE Observability itself. | ||
fvlankvelt marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
|
||
| A number of `RoleTemplate`s are available to achieve this, with common groupings of permissions. Binding these templates to users or groups on a cluster or namespace will trigger roles and role-bindinds to be provisioned on the target cluster. The default templates are described below. Note that it is possible to define your own combinations of permissions in a custom RoleTemplate. | ||
|
|
||
| ### Observer role | ||
|
|
||
| The observer role grants a user the permission to read topology, metrics, logs and trace data for a namespace or a cluster. There are three `RoleTemplate`s that grant access to observability data: | ||
|
|
||
| * **Observer** - grants access to data coming from namespaces in a Project. This can be used in the "Project Membership" section of the cluster configuration. | ||
| * **Cluster Observer** - grants access to all data coming from a Cluster. This template can be used in the "Cluster Membership" section of the cluster configuration. | ||
| * **Instance Observer** - grants access to all data in a SUSE Observability instance. This template can be used on the Project that includes SUSE Observability itself. | ||
|
|
||
| In order to use these observer roles, it is recommended that the following role is granted on the Project running SUSE Observability itself: | ||
| * **Recommended Access** - has recommended permissions for using SUSE Observability. | ||
|
|
||
| ### Instance roles | ||
|
|
||
| There are two roles predefined in SUSE Observability, allowing for configuring the system - setting up views, monitors, notitifications etcetera: | ||
| As these concern "global" settings of SUSE Observability, these roles include access to all data in an observability instance. | ||
|
|
||
| * **Instance Troubleshooter** - has all permissions required to use SUSE Observability for troubleshooting, including the ability to enable/disable monitors, create custom views and use the Cli. | ||
| * **Instance Administrator** - has full access to all views and has all permissions. | ||
|
|
||
| The permissions assigned to each predefined SUSE Observability role can be found below. For details of the different permissions and how to manage them using the `sts` CLI, see [Role based access control (RBAC) permissions](/setup/security/rbac/rbac_permissions.md) | ||
|
|
||
| {% tabs %} | ||
| {% tab title="Recommended Access" %} | ||
| Recommended access grants permissions that are not strictly necessary, but that make SUSE Observability a lot more useful. | ||
|
|
||
| | Resource | Verbs | | ||
| | --- | --- | | ||
| | apitokens | get | | ||
| | favoritedashboards | create, delete | | ||
| | favoriteviews | create, delete | | ||
| | stackpacks | get | | ||
| | visualizationsettings | update | | ||
|
|
||
| {% endtab %} | ||
|
|
||
| {% tab title="Troubleshooter" %} | ||
| The Troubleshooter role has access to all data available in SUSE Observability and the ability to create views and enable/disable monitors. | ||
|
|
||
| | Resource | Verbs | | ||
| | --- | --- | | ||
| | agents | get | | ||
| | apitokens | get | | ||
| | componentactions | execute | | ||
| | dashboards | get, create, update, delete | | ||
| | favoritedashboards | create, delete | | ||
| | favoriteviews | create, delete | | ||
| | metricbindings | get | | ||
| | metrics | get | | ||
| | monitors | get, create, update, delete, execute | | ||
| | notifications | get, create, update, delete | | ||
| | settings | get | | ||
| | stackpackconfigurations | get, create, update, delete | | ||
| | stackpacks | get | | ||
| | systemnotifications | get | | ||
| | topology | get | | ||
| | traces | get | | ||
| | views | get, create, update, delete | | ||
| | visualizationsettings | get | | ||
|
|
||
| {% endtab %} | ||
|
|
||
| {% tab title="Administrator" %} | ||
| The Administrator role has all permissions assigned. | ||
|
|
||
| | Resource | Verbs | | ||
| | --- | --- | | ||
| | agents | get | | ||
| | apitokens | get | | ||
| | componentactions | execute | | ||
| | dashboards | get, create, update, delete | | ||
| | favoritedashboards | create, delete | | ||
| | favoriteviews | create, delete | | ||
| | ingestionapikeys | get, create, update, delete | | ||
| | metricbindings | get | | ||
| | metrics | get | | ||
| | monitors | get, create, update, delete, execute | | ||
| | notifications | get, create, update, delete | | ||
| | permissions | get, create, update, delete | | ||
| | restrictedscripts | execute | | ||
| | servicetokens | get, create, update, delete | | ||
| | settings | get, create, update, delete, unlock | | ||
| | stackpackconfigurations | get, create, update, delete | | ||
| | stackpacks | get, create | | ||
| | syncdata | get, update, delete | | ||
| | systemnotifications | get | | ||
| | topicmessages | get | | ||
| | topology | get | | ||
| | traces | get | | ||
| | views | get, create, update, delete | | ||
| | visualizationsettings | update | | ||
|
|
||
| {% endtab %} | ||
|
|
||
|
|
||
| ### Resource details | ||
|
|
||
| These resources correspond to data collected by the SUSE Observability agent and access should typically be limited on a cluster or a namespace level. The following resources are available in the `scope.observability.cattle.io` API Group: | ||
|
|
||
| * `topology` - components (deployments, pods, etcetera) from the cluster or namespace | ||
| * `traces` - spans from the cluster or namespace | ||
| * `metrics` - metric data originating from the cluster or namespace | ||
|
|
||
| These resources can only be read, so the only applicable verb is `get`. | ||
|
|
||
| Apart from these RBAC resources controlling access to observability data, "instance" resources define user capabilities for executing and configuring SUSE Observability: | ||
|
|
||
| | Resource | Verbs | Description | | ||
| | --- | --- | --- | | ||
| | `agents` | `get` | List connected agents with the cli `agent list` command | | ||
| | `apitokens` | `get` | Access the CLI page. This provides the API key to use for authentication with the SUSE Observability CLI | | ||
| | `componentactions` | `execute` | Execute [component actions](/use/views/k8s-topology-perspective.md#actions) | | ||
| | `dashboards` | `get`, `create`, `update`, `delete` | View, create, delete and change dashboards | | ||
| | `favoritedashboards` | `create`, `delete` | Manage a personal shortlist of dashboards | | ||
| | `favoriteviews` | `create`, `delete` | Manage a personal shortlist of views | | ||
| | `ingestionapikeys` | `get`, `create`, `delete` | Manage [API keys](/use/security/k8s-ingestion-api-keys.md) for data ingestion | | ||
| | `metricbindings` | `get`, `create`, `update`, `delete` | Create, delete and change [metric bindings](/use/metrics/k8s-add-charts.md) | | ||
| | `monitors` | `get`, `create`, `update`, `delete` | Create, delete and change [monitors](/use/alerting/k8s-monitors.md) | | ||
| | `notifications` | `get`, `create`, `update`, `delete` | Create, delete and change [notifications](/use/alerting/notifications/configure.md) | | ||
| | `restrictedscripts` | `execute` | Execute scripts using the HTTP script API in the SUSE Observability UI analytics environment. Also requires `scripts` | | ||
| | `scripts` | `execute` | Execute a query in the SUSE Observability UI Analytics environment. The `restrictedscripts` resource is also required to execute scripts using the HTTP script API | | ||
| | `servicetokens` | `get`, `create`, `delete` | Create/delete [Service Tokens](/use/security/k8s-service-tokens.md) in SUSE Observability | | ||
| | `settings` | `get`, `create`, `update`, `delete`, `unlock` | Export, import, delete, change and unlock settings | | ||
| | `stackpackconfigurations` | `create`, `update`, `delete` | Create, delete and change Stackpack conigurations | | ||
| | `stackpacks` | `get`, `create` | List and upload Stackpacks | | ||
| | `syncdata` | `get`, `delete` | Access SUSE Observability synchronization status and data using the CLI, reset and delete a synchronization | | ||
| | `systemnotifications` | `get` | Access the system notifications in the UI | | ||
| | `topicmessages` | `get` | Access SUSE Observability Receiver data using the CLI | | ||
| | `views` | `get`, `create`, `update`, `delete` | Access, create, delete and change [views](/use/views/k8s-custom-views.md) in the SUSE Observability UI | | ||
| | `visualizationsettings` | `update` | Change [visualization settings](/use/views/k8s-topology-perspective.md#visualization-settings). | | ||
|
|
||
|
|
||
| ### Granting permissions to every authenticated user | ||
|
|
||
| Every authenticated user is automatically added to the `system:authenticated` group. So if you want to grant permissions to, say, view metricbindings, this can be achieved with the manifest: | ||
| ``` | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: Role | ||
| metadata: | ||
| name: everyone-gets-to-see-metricbindings | ||
| rules: | ||
| - apiGroups: | ||
| - instance.observability.cattle.io | ||
| resources: | ||
| - metricbindings | ||
| verbs: | ||
| - get | ||
| --- | ||
| apiVersion: rbac.authorization.k8s.io/v1 | ||
| kind: RoleBinding | ||
| metadata: | ||
| name: everyone-gets-to-see-metricbindings | ||
| roleRef: | ||
| kind: Role | ||
| name: everyone-gets-to-see-metricbindings | ||
| apiGroup: rbac.authorization.k8s.io | ||
| subjects: | ||
| - kind: Group | ||
| name: "system:authenticated" | ||
| ``` | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.