-
Notifications
You must be signed in to change notification settings - Fork 556
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
🌱 Propose namespaced IAM identities #5054
base: main
Are you sure you want to change the base?
🌱 Propose namespaced IAM identities #5054
Conversation
In the [single cluster multitenancy] proposal, the functional requirement [FR4] introduced the use of cluster-wide resources, managed by the CAPI maintainers and hence preventing privilege escalation, through administrator review. In large organisations favouring autonomy, this brings high responsibility on the team operating CAPA. They need to judge which roles can be used in which namespaces. This breaks the autonomy principle those organisations have. In this situation, the current model introduces two sources to trust (the CAPA operator and the team operating it) and reduces the cluster operator autonomy to create clusters in new accounts. Goals --- 1. To enable AWSIdentity resources granting autonomy to cluster administrators to deploy clusters in their own accounts 2. To enable cluster administrators to allow of forbid AWSIdentities in their accounts
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Welcome @tjamet! |
Hi @tjamet. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
||
The `SourceIdentity` may be customisable by the CAPA owners to customise a certain prefix and hence increase the unicity of the requests. | ||
The default `SourceIdentity` field may look like `CAPA:provider:aws:AWSRoleIdentity:identity-namespace:identity-name`. The values `AWSRoleIdentity`, `identity-namespace` | ||
and `identity-name` refer to kubernetes resources and must be injected by the CAPA controller without any posibility to be changed by neither the CAPA owners or the cluster administrators. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This isn't entirely clear to me - is the proposal that once created, the value for SourceIdentity
is made up of values taken from the AWSStaticIdentity
or AWSRoleIdentity
? So this value is readable/buildable to the CAPA owners and cluster administrators because they can read the Kubernetes objects, but they would not be able to modify it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
the value of SourceIdentity
must be composed by the kind
of identity, as well as their namespace and name.
for example, if you have an identity
kind: AWSRoleIdentity
metadata:
namespace: my-namespace
name: my-name
the SourceIdentity
must be CAPA:provider:aws:AWSRoleIdentity:my-namespace:my-name
. It must not be possible to change any part of the SourceIdentity
field by the AWSRoleIdentity
object
Does it make it any clearer?
Thank you! I should be able to attend for about 30mn 1h |
In the single cluster multitenancy proposal, the functional requirement [FR4] introduced the use of cluster-wide resources, managed by the CAPI maintainers and hence preventing privilege escalation, through administrator review.
In large organisations favouring autonomy, this brings high responsibility on the team operating CAPA. They need to judge which roles can be used in which namespaces. This breaks the autonomy principle those organisations have.
In this situation, the current model introduces two sources to trust (the CAPA operator and the team operating it) and reduces the cluster operator autonomy to create clusters in new accounts.
Goals
Special notes for your reviewer:
Checklist:
adds unit testsproposal documentation change onlyadds or updates e2e testsproposal documentation change onlyRelease note: