From deecfd02896e06bade8119095c3682e88e17c09a Mon Sep 17 00:00:00 2001 From: Jen Travinski Date: Mon, 20 Sep 2021 18:39:50 -0400 Subject: [PATCH] Provided example yaml and kubectl commands on how to configure additional monitoring roles (#3518) * Added examples and hard breaks between elements, removed duplicate header in TOC v2.6 * Added examples of YAML for Roles & RoleBindings * Added hard breaks between elements, removed duplicate header in TOC v2.5 * Added new section for YAML/kubectl * Updated 2.5, 2.6 yaml examples * Updated for 2.5 * Updated for 2.6 * Updated yaml and kubectl files for 2.5/2.6 * Updated v2.5, v2.6 to remove CRB label from Roles --- .../en/monitoring-alerting/rbac/_index.md | 33 ++++++++++++++++-- .../en/monitoring-alerting/rbac/_index.md | 34 +++++++++++++++++-- 2 files changed, 61 insertions(+), 6 deletions(-) diff --git a/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md b/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md index 4c703ba37fe..4bc0e009c2a 100644 --- a/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md +++ b/content/rancher/v2.5/en/monitoring-alerting/rbac/_index.md @@ -16,7 +16,6 @@ This section describes the expectations for RBAC for Rancher Monitoring. - [Users with Kubernetes View Permissions](#users-with-kubernetes-view-permissions) - [Additional Monitoring Roles](#additional-monitoring-roles) - [Additional Monitoring ClusterRoles](#additional-monitoring-clusterroles) -- [Additional Monitoring Roles](#additional-monitoring-roles) - [Users with Rancher Cluster Manager Based Permissions](#users-with-rancher-cluster-manager-based-permissions) - [Differences in 2.5.x](#differences-in-2-5-x) - [Assigning Additional Access](#assigning-additional-access) @@ -70,7 +69,7 @@ Only those with who have some Kubernetes `ClusterRole` should be able to: ### Additional Monitoring Roles -Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a `RoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). Admins should use these roles to provide more fine-grained access to users: @@ -85,12 +84,40 @@ Admins should use these roles to provide more fine-grained access to users: ### Additional Monitoring ClusterRoles -Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). | Role | Purpose | | ------------------------------| ---------------------------| | monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ Provides read-only access to external Monitoring UIs by giving a user permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +### Assigning Roles and ClusterRoles with kubectl + +An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` with the YAML file, then you apply the config changes by running the `kubectl apply` command. + + +* **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes to attach to a user. You will need to fill in the name below, and name is case-sensitive. + +``` +# monitoring-config-view-role-binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: monitoring-config-view + namespace: cattle-monitoring-system +roleRef: + kind: Role + name: monitoring-config-view + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: User + name: u-b4qkhsnliz # this can be found via `kubectl get users -A` + apiGroup: rbac.authorization.k8s.io +``` + +* **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. + + * **`kubectl apply -f monitoring-config-view-role-binding.yaml` + # Users with Rancher Cluster Manager Based Permissions The relationship between the default roles deployed by Rancher Cluster Manager (i.e. cluster-owner, cluster-member, project-owner, project-member), the default k8s roles, and the roles deployed by the rancher-monitoring chart are detailed in the table below: diff --git a/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md b/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md index cca1942fff3..ba487525225 100644 --- a/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md +++ b/content/rancher/v2.6/en/monitoring-alerting/rbac/_index.md @@ -11,7 +11,6 @@ This section describes the expectations for RBAC for Rancher Monitoring. - [Users with Kubernetes View Permissions](#users-with-kubernetes-view-permissions) - [Additional Monitoring Roles](#additional-monitoring-roles) - [Additional Monitoring ClusterRoles](#additional-monitoring-clusterroles) -- [Additional Monitoring Roles](#additional-monitoring-roles) - [Users with Rancher Based Permissions](#users-with-rancher-based-permissions) - [Differences in 2.5.x](#differences-in-2-5-x) - [Assigning Additional Access](#assigning-additional-access) @@ -65,7 +64,7 @@ Only those with who have some Kubernetes `ClusterRole` should be able to: ### Additional Monitoring Roles -Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `Roles` that are not assigned to users by default but are created within the cluster. They can be bound to a namespace by deploying a `RoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). Admins should use these roles to provide more fine-grained access to users: @@ -80,12 +79,41 @@ Admins should use these roles to provide more fine-grained access to users: ### Additional Monitoring ClusterRoles -Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a RoleBinding that references it. +Monitoring also creates additional `ClusterRoles` that are not assigned to users by default but are created within the cluster. They are not aggregated by default but can be bound to a namespace by deploying a `RoleBinding` or `ClusterRoleBinding` that references it. To define a `RoleBinding` with `kubectl` instead of through Rancher, click [here](#assigning-roles-and-clusterroles-with-kubectl). | Role | Purpose | | ------------------------------| ---------------------------| | monitoring-ui-view | _Available as of Monitoring v2 14.5.100+_ Provides read-only access to external Monitoring UIs by giving a user permission to list the Prometheus, Alertmanager, and Grafana endpoints and make GET requests to Prometheus, Grafana, and Alertmanager UIs through the Rancher proxy. | +### Assigning Roles and ClusterRoles with kubectl + +An alternative method to using Rancher to attach a `Role` or `ClusterRole` to a user or group is by defining bindings in YAML files that you create. You must first configure the `RoleBinding` with the YAML file, then you apply the config changes by running the `kubectl apply` command. + + +* **Roles**: Below is an example of a YAML file to help you configure `RoleBindings` in Kubernetes. You will need to fill in the name below, and name is case-sensitive. + +``` +# monitoring-config-view-role-binding.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: monitoring-config-view + namespace: cattle-monitoring-system +roleRef: + kind: Role + name: monitoring-config-view + apiGroup: rbac.authorization.k8s.io +subjects: +- kind: User + name: u-b4qkhsnliz # this can be found via `kubectl get users -A` + apiGroup: rbac.authorization.k8s.io +``` + +* **kubectl**: Below is an example of a `kubectl` command used to apply the binding you've created in the YAML file. As noted, you will need to fill in your YAML filename accordingly. + + * **`kubectl apply -f monitoring-config-view-role-binding.yaml` + + # Users with Rancher Based Permissions The relationship between the default roles deployed by Rancher (i.e. cluster-owner, cluster-member, project-owner, project-member), the default Kubernetes roles, and the roles deployed by the rancher-monitoring chart are detailed in the table below: