From 96d739a94d6b6597301a76dff4d3822c8c97b825 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 1 May 2023 14:49:53 -0700 Subject: [PATCH 1/4] Add mention that monitoring-ui-view gives access to metrics graphs and example commands --- .../rbac-for-monitoring.md | 62 +++++++++++++++---- 1 file changed, 51 insertions(+), 11 deletions(-) diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 505051ccaee..cd5d2bec29a 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -72,7 +72,7 @@ Admins may assign custom roles in the Rancher UI for admin, editing, and viewing :::note Important -The UI will not offer `monitoring-admin`, `monitoring-edit`, and `monitoring-view` options when users are being added to a cluster. These monitoring roles can only be assigned by manually creating a custom role that inherits from Project Owner and Project Monitoring View roles. +The UI will not offer `monitoring-admin`, `monitoring-edit`, and `monitoring-view` options when users are being added to a cluster. These monitoring roles can only be assigned by manually creating a custom role that inherits from Project Owner and Project Monitoring View roles. ::: @@ -104,18 +104,60 @@ The UI will not offer `monitoring-admin`, `monitoring-edit`, and `monitoring-vie ### Additional Monitoring ClusterRoles -Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). +Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ Provides read-only access to external Monitoring UIs by giving a user permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole gives access to metrics graphs in the Rancher UI for the specific cluster. It does so by providing read-only access to external Monitoring UIs by giving a user permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | ### Assigning Roles and ClusterRoles with kubectl -An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` with the YAML file, then you apply the config changes by running the `kubectl apply` command. +An alternative method to using Rancher to attach a `Role` or `ClusterRole` is to a user or group is with `kubectl`. +#### Using `kubectl create` -* **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, and name is case-sensitive. +One method is to use either `kubectl create clusterrolebinding` or `kubectl create rolebinding` to assign a `Role` or `ClusterRole`. This is shown in the following examples: + +- Assign to a specific user: + + + + ```plain + kubectl create clusterrolebinding my-binding --clusterrole=monitoring-ui-view --user=u-l4npx + ``` + + + + + ```plain + kubectl create rolebinding my-binding --clusterrole=monitoring-ui-view --user=u-l4npx --namespace=my-namespace + ``` + + + +- Assign to all authenticated users: + + + + ```plain + kubectl create clusterrolebinding my-binding --clusterrole=monitoring-ui-view --group=system:authenticated + ``` + + + + + ```plain + kubectl create rolebinding my-binding --clusterrole=monitoring-ui-view --group=system:authenticated --namespace=my-namespace + ``` + + + + +#### Using YAML Files + +An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` or `ClusterRoleBinding` with a YAML file, then you apply the config changes by running the `kubectl apply` command. + +- **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, and name is case-sensitive. ```yaml # monitoring-config-view-role-binding.yaml @@ -134,10 +176,10 @@ subjects: apiGroup: rbac.authorization.k8s.io ``` -* **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. - - * **`kubectl apply -f monitoring-config-view-role-binding.yaml` - +- **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. + ``` + kubectl apply -f monitoring-config-view-role-binding.yaml + ``` ## Users with Rancher Based Permissions @@ -184,8 +226,6 @@ If cluster-admins would like to provide additional admin/edit access to users ou | | `cattle-monitoring-system` | Yes, Configs and Secrets in this namespace can impact the entire monitoring / alerting pipeline. | User will be able to create or edit Secrets / ConfigMaps such as the Alertmanager Config, Prometheus Adapter Config, TLS secrets, additional Grafana datasources, etc. This can have broad impact on all cluster monitoring / alerting. | | | `cattle-dashboards` | Yes, Configs and Secrets in this namespace can create dashboards that make queries on all metrics collected at a cluster-level. | User will be able to create Secrets / ConfigMaps that persist new Grafana Dashboards only. | - - ## Role-based Access Control for Grafana Rancher allows any users who are authenticated by Kubernetes and have access the Grafana service deployed by the Rancher Monitoring chart to access Grafana via the Rancher Dashboard UI. By default, all users who are able to access Grafana are given the [Viewer](https://grafana.com/docs/grafana/latest/permissions/organization_roles/#viewer-role) role, which allows them to view any of the default dashboards deployed by Rancher. From 1e55f96127afe137ccbd6b4eb0d70dd96966af02 Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Mon, 1 May 2023 19:00:37 -0700 Subject: [PATCH 2/4] Minor wording adjustment and formatting fixes --- .../monitoring-and-alerting/rbac-for-monitoring.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index cd5d2bec29a..2e9f637c489 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -155,9 +155,9 @@ One method is to use either `kubectl create clusterrolebinding` or `kubectl crea #### Using YAML Files -An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` or `ClusterRoleBinding` with a YAML file, then you apply the config changes by running the `kubectl apply` command. +Another method is to define bindings in YAML files that you create. You must first configure the `RoleBinding` or `ClusterRoleBinding` with a YAML file, then you apply the configuration changes by running the `kubectl apply` command. -- **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, and name is case-sensitive. +- **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, which is case-sensitive. ```yaml # monitoring-config-view-role-binding.yaml @@ -177,7 +177,7 @@ subjects: ``` - **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. - ``` + ```plain kubectl apply -f monitoring-config-view-role-binding.yaml ``` From 484c5ea9aecd351cfbd7f6cac9cfe15cf8acdafe Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 2 May 2023 10:06:09 -0700 Subject: [PATCH 3/4] Apply suggestions from code review Co-authored-by: Marty Hernandez Avedon --- .../rbac-for-monitoring.md | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 2e9f637c489..75c354c0f5d 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -72,7 +72,7 @@ Admins may assign custom roles in the Rancher UI for admin, editing, and viewing :::note Important -The UI will not offer `monitoring-admin`, `monitoring-edit`, and `monitoring-view` options when users are being added to a cluster. These monitoring roles can only be assigned by manually creating a custom role that inherits from Project Owner and Project Monitoring View roles. +The UI won't offer `monitoring-admin`, `monitoring-edit`, and `monitoring-view` options when users are being added to a cluster. These monitoring roles can only be assigned by manually creating a custom role that inherits from Project Owner and Project Monitoring View roles. ::: @@ -104,15 +104,14 @@ The UI will not offer `monitoring-admin`, `monitoring-edit`, and `monitoring-vie ### Additional Monitoring ClusterRoles -Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). +Monitoring also creates additional `ClusterRoles` that aren't assigned to users by default but are created within the cluster. They aren't aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). | Role | Purpose | | ------------------------------| ---------------------------| -| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole gives access to metrics graphs in the Rancher UI for the specific cluster. It does so by providing read-only access to external Monitoring UIs by giving a user permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +| monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ This ClusterRole allows users to view metrics graphs for the specified cluster in the Rancher UI. This is done by granting read-only access to external Monitoring UIs. Users with this role have permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | ### Assigning Roles and ClusterRoles with kubectl -An alternative method to using Rancher to attach a `Role` or `ClusterRole` is to a user or group is with `kubectl`. #### Using `kubectl create` @@ -155,9 +154,15 @@ One method is to use either `kubectl create clusterrolebinding` or `kubectl crea #### Using YAML Files -Another method is to define bindings in YAML files that you create. You must first configure the `RoleBinding` or `ClusterRoleBinding` with a YAML file, then you apply the configuration changes by running the `kubectl apply` command. +Another method is to define bindings in YAML files that you create. You must first configure the `RoleBinding` or `ClusterRoleBinding` with a YAML file. Then, apply the configuration changes by running the `kubectl apply` command. -- **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, which is case-sensitive. +- **Roles**: Below is an example YAML file to help you configure `RoleBindings` in Kubernetes. You'll need to fill in the name below. + +:::note + +Names are case-sensitive. + +::: ```yaml # monitoring-config-view-role-binding.yaml @@ -176,7 +181,7 @@ subjects: apiGroup: rbac.authorization.k8s.io ``` -- **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. +- **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. Remember to fill in your YAML filename accordingly. ```plain kubectl apply -f monitoring-config-view-role-binding.yaml ``` From 479d5f802086bf2d4b061035188c5dc17fc839fb Mon Sep 17 00:00:00 2001 From: Billy Tat Date: Tue, 2 May 2023 10:28:12 -0700 Subject: [PATCH 4/4] Apply updates to 2.6 --- .../rbac-for-monitoring.md | 4 +- .../rbac-for-monitoring.md | 62 ++++++++++++++++--- 2 files changed, 55 insertions(+), 11 deletions(-) diff --git a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 75c354c0f5d..7993c1040c6 100644 --- a/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/docs/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -99,7 +99,6 @@ The UI won't offer `monitoring-admin`, `monitoring-edit`, and `monitoring-view` 2.4 Click **Create**. - **Result:** The new user should now be able to see the monitoring tools. ### Additional Monitoring ClusterRoles @@ -112,7 +111,6 @@ Monitoring also creates additional `ClusterRoles` that aren't assigned to users ### Assigning Roles and ClusterRoles with kubectl - #### Using `kubectl create` One method is to use either `kubectl create clusterrolebinding` or `kubectl create rolebinding` to assign a `Role` or `ClusterRole`. This is shown in the following examples: @@ -156,7 +154,7 @@ One method is to use either `kubectl create clusterrolebinding` or `kubectl crea Another method is to define bindings in YAML files that you create. You must first configure the `RoleBinding` or `ClusterRoleBinding` with a YAML file. Then, apply the configuration changes by running the `kubectl apply` command. -- **Roles**: Below is an example YAML file to help you configure `RoleBindings` in Kubernetes. You'll need to fill in the name below. +- **Roles**: Below is an example YAML file to help you configure `RoleBindings` in Kubernetes. You'll need to fill in the name below. :::note diff --git a/versioned_docs/version-2.6/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md b/versioned_docs/version-2.6/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md index 505051ccaee..9ef6362e49b 100644 --- a/versioned_docs/version-2.6/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md +++ b/versioned_docs/version-2.6/integrations-in-rancher/monitoring-and-alerting/rbac-for-monitoring.md @@ -72,7 +72,7 @@ Admins may assign custom roles in the Rancher UI for admin, editing, and viewing :::note Important -The UI will not offer `monitoring-admin`, `monitoring-edit`, and `monitoring-view` options when users are being added to a cluster. These monitoring roles can only be assigned by manually creating a custom role that inherits from Project Owner and Project Monitoring View roles. +The UI won't offer `monitoring-admin`, `monitoring-edit`, and `monitoring-view` options when users are being added to a cluster. These monitoring roles can only be assigned by manually creating a custom role that inherits from Project Owner and Project Monitoring View roles. ::: @@ -104,7 +104,7 @@ The UI will not offer `monitoring-admin`, `monitoring-edit`, and `monitoring-vie ### Additional Monitoring ClusterRoles -Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). +Monitoring also creates additional `ClusterRoles` that aren't assigned to users by default but are created within the cluster. They aren't aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). | Role | Purpose | | ------------------------------| ---------------------------| @@ -112,10 +112,56 @@ Monitoring also creates additional `ClusterRoles` that are not assigned to users ### Assigning Roles and ClusterRoles with kubectl -An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` with the YAML file, then you apply the config changes by running the `kubectl apply` command. +#### Using `kubectl create` +One method is to use either `kubectl create clusterrolebinding` or `kubectl create rolebinding` to assign a `Role` or `ClusterRole`. This is shown in the following examples: -* **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, and name is case-sensitive. +- Assign to a specific user: + + + + ```plain + kubectl create clusterrolebinding my-binding --clusterrole=monitoring-ui-view --user=u-l4npx + ``` + + + + + ```plain + kubectl create rolebinding my-binding --clusterrole=monitoring-ui-view --user=u-l4npx --namespace=my-namespace + ``` + + + +- Assign to all authenticated users: + + + + ```plain + kubectl create clusterrolebinding my-binding --clusterrole=monitoring-ui-view --group=system:authenticated + ``` + + + + + ```plain + kubectl create rolebinding my-binding --clusterrole=monitoring-ui-view --group=system:authenticated --namespace=my-namespace + ``` + + + + +#### Using YAML Files + +Another method is to define bindings in YAML files that you create. You must first configure the `RoleBinding` or `ClusterRoleBinding` with a YAML file. Then, apply the configuration changes by running the `kubectl apply` command. + +- **Roles**: Below is an example YAML file to help you configure `RoleBindings` in Kubernetes. You'll need to fill in the name below. + +:::note + +Names are case-sensitive. + +::: ```yaml # monitoring-config-view-role-binding.yaml @@ -134,10 +180,10 @@ subjects: apiGroup: rbac.authorization.k8s.io ``` -* **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. - - * **`kubectl apply -f monitoring-config-view-role-binding.yaml` - +- **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. Remember to fill in your YAML filename accordingly. + ```plain + kubectl apply -f monitoring-config-view-role-binding.yaml + ``` ## Users with Rancher Based Permissions