mirror of
https://github.com/kubevirt/containerized-data-importer.git
synced 2025-06-03 06:30:22 +00:00
e4fa647eea
* allow user with 'create pod' permission in source namespace to clone PVCs also refactored Kubevirt interface to clone permission check * make sure DataVolume spec is immutable also don't check perms when clone source namespace = dest namespace
165 lines
3.8 KiB
Markdown
165 lines
3.8 KiB
Markdown
# CDI RBAC
|
|
|
|
This document describes how to add RBAC permision for CDI to non admin Kubernetes users.
|
|
|
|
## DataVolumes
|
|
|
|
To allow user Joe to fully manage DataVolumes in all namespaces, apply the following manifest.
|
|
|
|
```yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: datavolume-admin
|
|
rules:
|
|
- apiGroups: ["cdi.kubevirt.io"]
|
|
resources: ["datavolumes"]
|
|
verbs: ["*"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: joe-datavolume-admin
|
|
subjects:
|
|
- kind: User
|
|
name: Joe
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: datavolume-admin
|
|
apiGroup: rbac.authorization.k8s.io
|
|
```
|
|
|
|
To only give Joe permission to mananage DataVolumes in the `project1` namespace, replace the `ClusterRoleBinding` above with:
|
|
|
|
```yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: joe-datavolume-admin
|
|
namespace: project1
|
|
subjects:
|
|
- kind: User
|
|
name: Joe
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: datavolume-admin
|
|
apiGroup: rbac.authorization.k8s.io
|
|
```
|
|
|
|
## Upload Token
|
|
|
|
Before uploading data to a PVC, users must submit an UploadTokenRequest. The following manifest will give user Joe permission to upload to PVCs in the `project1` namespace.
|
|
|
|
```yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cdi-uploader
|
|
rules:
|
|
- apiGroups: ["upload.cdi.kubevirt.io"]
|
|
resources: ["uploadtokenrequests"]
|
|
verbs: ["create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: joe-cdi-uploader
|
|
namespace: project1
|
|
subjects:
|
|
- kind: User
|
|
name: Joe
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: cdi-uploader
|
|
apiGroup: rbac.authorization.k8s.io
|
|
```
|
|
|
|
## PVC Cloning
|
|
|
|
Extra RBAC permission may be required for Datavolumes with `PVC` source. If a user does not have `create pod` permission in the source PVC namespace, a user may be given permission to "source" clones from the namespace. For Joe to create clones from PVCs in the `golden-images` namespace, execute thefollowing manifest.
|
|
|
|
```yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: cdi-cloner
|
|
rules:
|
|
- apiGroups: ["cdi.kubevirt.io"]
|
|
resources: ["datavolumes/source"]
|
|
verbs: ["create"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: RoleBinding
|
|
metadata:
|
|
name: joe-cdi-cloner
|
|
namespace: golden-images
|
|
subjects:
|
|
- kind: User
|
|
name: Joe
|
|
apiGroup: rbac.authorization.k8s.io
|
|
roleRef:
|
|
kind: ClusterRole
|
|
name: cdi-cloner
|
|
apiGroup: rbac.authorization.k8s.io
|
|
|
|
```
|
|
|
|
## Addendum: One way to create Users
|
|
|
|
This section may be helpful if you want to create a Kubernetes/Openshift user.
|
|
|
|
```bash
|
|
# create private key
|
|
openssl genrsa -out joe.key 2048
|
|
|
|
# create certificate signing request
|
|
openssl req -new -key joe.key -out joe.csr -subj "/CN=joe/O=group1"
|
|
|
|
# send CSR to k8s for approval
|
|
cat <<EOF | kubectl create -f -
|
|
apiVersion: certificates.k8s.io/v1beta1
|
|
kind: CertificateSigningRequest
|
|
metadata:
|
|
name: joe-csr
|
|
spec:
|
|
groups:
|
|
- system:authenticated
|
|
request: $(cat joe.csr | base64 | tr -d '\n')
|
|
usages:
|
|
- digital signature
|
|
- key encipherment
|
|
- client auth
|
|
EOF
|
|
|
|
# approve the CSR
|
|
|
|
# kubernetes
|
|
kubectl certificate approve joe-csr
|
|
|
|
# Openshift
|
|
oc adm certificate approve joe-csr
|
|
|
|
# get the signed cert
|
|
kubectl get csr joe-csr -o jsonpath='{.status.certificate}' | base64 -d > joe.crt
|
|
|
|
# add creds to kubeconfig
|
|
kubectl config set-credentials joe --client-certificate=joe.crt --client-key=joe.key --embed-certs=true
|
|
|
|
# lookup clusters
|
|
kubectl config get-clusters
|
|
|
|
# set cntext of cluster to connect to
|
|
kubectl config set-context joe-context --cluster=<cluster from above> --namespace=<mynamespace> --user=joe
|
|
|
|
# Assign permissions to user like above
|
|
|
|
# use the new user context
|
|
kubectl config use-context joe-context
|
|
|
|
```
|
|
|
|
|