🌱 Propose namespaced IAM identities

[tjamet]

In the single cluster multitenancy proposal, the functional requirement [FR4] introduced the use of cluster-wide resources, managed by the CAPI maintainers and hence preventing privilege escalation, through administrator review.

In large organisations favouring autonomy, this brings high responsibility on the team operating CAPA. They need to judge which roles can be used in which namespaces. This breaks the autonomy principle those organisations have.

In this situation, the current model introduces two sources to trust (the CAPA operator and the team operating it) and reduces the cluster operator autonomy to create clusters in new accounts.

Goals

1. To enable AWSIdentity resources granting autonomy to cluster administrators to deploy clusters in their own accounts
2. To enable cluster administrators to allow of forbid AWSIdentities in their accounts

Special notes for your reviewer:

Checklist:

• squashed commits
• includes documentation
• includes emojis
• adds unit tests proposal documentation change only
• adds or updates e2e tests proposal documentation change only

Release note:

NONE

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign chrischdi for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

Welcome @tjamet!

It looks like this is your first PR to kubernetes-sigs/cluster-api-provider-aws 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cluster-api-provider-aws has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @tjamet. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[nrb]

/area security
/area api
/kind design

Thanks for this thorough proposal @tjamet! I've done an initial read, but I'd like some time to re-read and follow through some of the links.

I've added this to the agenda of the next community meeting, if you'll be able to attend.

[nrb]

This isn't entirely clear to me - is the proposal that once created, the value for SourceIdentity is made up of values taken from the AWSStaticIdentity or AWSRoleIdentity? So this value is readable/buildable to the CAPA owners and cluster administrators because they can read the Kubernetes objects, but they would not be able to modify it?

[tjamet]

the value of SourceIdentity must be composed by the kind of identity, as well as their namespace and name.

for example, if you have an identity

kind: AWSRoleIdentity
metadata:
  namespace: my-namespace
  name: my-name

the SourceIdentity must be CAPA:provider:aws:AWSRoleIdentity:my-namespace:my-name. It must not be possible to change any part of the SourceIdentity field by the AWSRoleIdentity object

Does it make it any clearer?

[tjamet]

I've added this to the agenda of the next community meeting, if you'll be able to attend.

Thank you!

I should be able to attend for about 30mn 1h