🌱 Propose namespaced IAM identities #5054
Conversation
In the [single cluster multitenancy] proposal, the functional requirement [FR4] introduced the use of cluster-wide resources, managed by the CAPI maintainers and hence preventing privilege escalation, through administrator review. In large organisations favouring autonomy, this brings high responsibility on the team operating CAPA. They need to judge which roles can be used in which namespaces. This breaks the autonomy principle those organisations have. In this situation, the current model introduces two sources to trust (the CAPA operator and the team operating it) and reduces the cluster operator autonomy to create clusters in new accounts. Goals --- 1. To enable AWSIdentity resources granting autonomy to cluster administrators to deploy clusters in their own accounts 2. To enable cluster administrators to allow of forbid AWSIdentities in their accounts
k8s-ci-robot
added
the
release-note-none
k8s-ci-robot
added
cncf-cla: yes
|
Welcome @tjamet! |
k8s-ci-robot
added
the
needs-ok-to-test
|
Hi @tjamet. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
the
size/L
k8s-ci-robot
added
area/security
|
|
||
| The `SourceIdentity` may be customisable by the CAPA owners to customise a certain prefix and hence increase the unicity of the requests. | ||
| The default `SourceIdentity` field may look like `CAPA:provider:aws:AWSRoleIdentity:identity-namespace:identity-name`. The values `AWSRoleIdentity`, `identity-namespace` | ||
| and `identity-name` refer to kubernetes resources and must be injected by the CAPA controller without any posibility to be changed by neither the CAPA owners or the cluster administrators. |
There was a problem hiding this comment.
This isn't entirely clear to me - is the proposal that once created, the value for SourceIdentity is made up of values taken from the AWSStaticIdentity or AWSRoleIdentity? So this value is readable/buildable to the CAPA owners and cluster administrators because they can read the Kubernetes objects, but they would not be able to modify it?
There was a problem hiding this comment.
the value of SourceIdentity must be composed by the kind of identity, as well as their namespace and name.
for example, if you have an identity
kind: AWSRoleIdentity
metadata:
namespace: my-namespace
name: my-namethe SourceIdentity must be CAPA:provider:aws:AWSRoleIdentity:my-namespace:my-name. It must not be possible to change any part of the SourceIdentity field by the AWSRoleIdentity object
Does it make it any clearer?
Thank you! I should be able to attend for about 30mn 1h |
|
The Kubernetes project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
k8s-ci-robot
added
the
lifecycle/stale
|
Hi! Coming back to this proposal after summer. /remove-lifecycle stale |
|
The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle rotten |
k8s-ci-robot
added
lifecycle/rotten
|
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /close |
|
@k8s-triage-robot: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/reopen |
|
@damdo: Reopened this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/remove-lifecycle rotten |
k8s-ci-robot
removed
the
lifecycle/rotten
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
In the single cluster multitenancy proposal, the functional requirement [FR4] introduced the use of cluster-wide resources, managed by the CAPI maintainers and hence preventing privilege escalation, through administrator review.
In large organisations favouring autonomy, this brings high responsibility on the team operating CAPA. They need to judge which roles can be used in which namespaces. This breaks the autonomy principle those organisations have.
In this situation, the current model introduces two sources to trust (the CAPA operator and the team operating it) and reduces the cluster operator autonomy to create clusters in new accounts.
Goals
Special notes for your reviewer:
Checklist:
adds unit testsproposal documentation change onlyadds or updates e2e testsproposal documentation change onlyRelease note: