Authentication Subsystem

[BugRoger]

There needs to be two Openstack roles:

1. kubernikus_admin
2. kubernikus_member

Generate certificates that use the principal from the Keystone token as username (CN). Depending on the Openstack the certificates organisation field is set to:

1. kubernikus:admins
2. kubernikus:members

This allows us to identify the user and her Openstack role. Then we preseed an RBAC rules into the customer's clusters, that add thekubernikus:admins group to system:masters (or the same roles).

In turn this also allows the customer to create their own RBAC rules for the kubernikus:members group. Management of who is allowed to access the Kluster is then possible using the usual Openstack role assignments.

Revocation of the certificates is being handled by lowering the certificates expiration time. Suggestion would be 30d as default. This can be configured by the customer and adjusted to his security needs.

With 1.8 it will be possible to create plugins for kubectl. It will then be trivially easy to automate the certificate renewal similar to monsoonctl using a plugin.

[BugRoger]

Plugin created: kubernikusctl credentials

[databus23]

The bulk of this ticket is hopefully implemented by e2369ec.

the /api/v1/cluster/:name/credentials endpoint now returns certificates that are valid for 24 hours only. The Organization part of the certificate subject now contains all the roles associated with the token (and therefore roles the user has the clusters openstack project). This allows to bind open stack roles to kubernetes RBAC definitions.
We now seed one ClusterRoleBinding when creating the kluster giving the user cluster-admin permissions when he has the openstack kubernetes_admin role.
More fine-grained settings with other open stack roles can be set up by the enduser.

I like it! :)

[BugRoger]

Missing docs and final touches on kubernikusctl download

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.