1(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[8338],{37994:function(i,s,e){(window.__NEXT_P=window.__NEXT_P||[]).push(["/architecture/access-control",function(){return e(62148)}])},62148:function(i,s,e){"use strict";e.r(s),e.d(s,{useTOC:function(){return d}});var n=e(85893),t=e(37812),h=e(39559),r=e(38925),l=e(98757),a=e(45192);function d(i){let s={code:"code",...(0,r.a)()};return[{value:"Flow",id:"flow",depth:2},{value:"Authentication",id:"authentication",depth:2},{value:"Authorization",id:"authorization",depth:2},{value:"SSH",id:"ssh",depth:3},{value:(0,n.jsxs)(n.Fragment,{children:["Ingress Tunnel (",(0,n.jsx)(s.code,{children:"ssh -L"}),")"]}),id:"ingress-tunnel-ssh--l",depth:3},{value:(0,n.jsxs)(n.Fragment,{children:["Egress Tunnel (",(0,n.jsx)(s.code,{children:"ssh -L"}),")"]}),id:"egress-tunnel-ssh--l",depth:3},{value:"SFTP(SCP)",id:"sftpscp",depth:3}]}s.default=(0,t.c)(function(i){let{toc:s=d(i)}=i,e={a:"a",code:"code",h1:"h1",h2:"h2",h3:"h3",li:"li",p:"p",pre:"pre",span:"span",ul:"ul",...(0,r.a)(),...i.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(e.h1,{children:"Access Control"}),"\n",(0,n.jsxs)(e.p,{children:["kty utilizes external systems for both authn and authz. To fetch your identity,\na combo of OpenID and the ",(0,n.jsx)(e.code,{children:"keys"})," resource in your cluster are used. These map\nfrom something external (an oauth identity token or a public key hash) to a\n",(0,n.jsx)(e.code,{children:"User"})," and ",(0,n.jsx)(e.code,{children:"Group"})," inside of k8s."]}),"\n",(0,n.jsxs)(e.p,{children:["Similar to authentication, kty does not do authorization itself. Instead, it\n",(0,n.jsx)(e.a,{href:"https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation",children:"impersonates"})," the authenticated user. Any action that is taken\nfrom that point forward uses the usersâ permissions as granted via. RBAC in k8s."]}),"\n",(0,n.jsx)(e.h2,{id:s[0].id,children:s[0].value}),"\n",(0,n.jsx)(l.G,{chart:"sequenceDiagram;\\n actor U as User;\\n participant S as kty;\\n participant C as Kubernetes;\\n participant P as OpenID Provider;\\n\\n U->>S: Public Key;\\n S-->>C: Key resource exists?;\\n\\n C-->>S: Unknown;\\n S->>P: Get OpenID Link;\\n P->>U: Display QR Code;\\n U->>P: Verify Identity;\\n S-->>P: Valid Token?;\\n P->>S: [email protected];\\n\\n Note over S,C: Impersonate [email protected];\\n S-->>C: Can list pods?;\\n C-->>S: Yes;\\n S->>U: Dashboard;"}),"\n",(0,n.jsx)(e.h2,{id:s[1].id,children:s[1].value}),"\n",(0,n.jsx)(e.p,{children:"There are two ways for an incoming SSH session to get a user identity:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:["OpenID - If the user does not have an authorized public key, the SSH session\nprompts with an open id flow. When that flow is successful, the returned token\nis mapped to a k8s identity. By default, this is the ",(0,n.jsx)(e.code,{children:"email"})," claim in the\nidentity token. If you would like to map different claims and/or add groups,\ntake a look at the server configuration."]}),"\n",(0,n.jsxs)(e.li,{children:["Public Key - By default, once a user has been authenticated with openid, they\nwill have a public key. This will contain the user and group information\nextracted from the identity token. If you would like to skip OpenID entirely,\nyou can create ",(0,n.jsx)(e.code,{children:"Key"})," resources, the ",(0,n.jsx)(e.code,{children:"kty users key"})," can be used to do this as\nan alternative to ",(0,n.jsx)(e.code,{children:"kubectl"}),"."]}),"\n"]}),"\n",(0,n.jsxs)(e.p,{children:["To validate that a user has access, you can use the ",(0,n.jsx)(e.code,{children:"kty users check"})," command.\nThis is a great way to debug why users are not being allowed to connect."]}),"\n",(0,n.jsx)(e.pre,{icon:a.Fx,tabIndex:"0","data-language":"bash","data-word-wrap":"","data-copy":"",children:(0,n.jsx)(e.code,{children:(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#6F42C1","--shiki-dark":"#B392F0"},children:"kty"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:" users"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:" check"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:" [email protected]"})]})})}),"\n",(0,n.jsx)(e.h2,{id:s[2].id,children:s[2].value}),"\n",(0,n.jsxs)(e.p,{children:["To be authorized, either the name or groups for a user need to have role\nbindings added to the cluster. The ",(0,n.jsx)(e.code,{children:"kty users grant"})," command is one way to go\nabout this, but it is purposely naive. To do something more flexible, you can\ncheck out ",(0,n.jsx)(e.code,{children:"kubectl"}),":"]}),"\n",(0,n.jsx)(e.pre,{icon:a.Fx,tabIndex:"0","data-language":"bash","data-word-wrap":"","data-copy":"",children:(0,n.jsx)(e.code,{children:(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#6F42C1","--shiki-dark":"#B392F0"},children:"kubectl"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:" create"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:" clusterrolebinding"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:" foo-bar-com"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#005CC5","--shiki-dark":"#79B8FF"},children:" --clusterrole="}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#D73A49","--shiki-dark":"#F97583"},children:"<"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#005CC5","--shiki-dark":"#79B8FF"},children:"my-role"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#D73A49","--shiki-dark":"#F97583"},children:">"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#005CC5","--shiki-dark":"#79B8FF"},children:" [email protected]"})]})})}),"\n",(0,n.jsxs)(e.p,{children:["Note that you can use a ",(0,n.jsx)(e.code,{children:"RoleBinding"})," instead, but only for specific\nfunctionality."]}),"\n",(0,n.jsx)(e.h3,{id:s[3].id,children:s[3].value}),"\n",(0,n.jsx)(e.p,{children:"The minimum permissions are:"}),"\n",(0,n.jsx)(e.pre,{tabIndex:"0","data-language":"yaml","data-word-wrap":"",children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'pods'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"}
1,children:"verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'list'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:", "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'watch'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]})]})}),"\n",(0,n.jsx)(e.p,{children:"To see logs:"}),"\n",(0,n.jsx)(e.pre,{tabIndex:"0","data-language":"yaml","data-word-wrap":"",children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'\"pods/log'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'get'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]})]})}),"\n",(0,n.jsx)(e.p,{children:"To get a shell:"}),"\n",(0,n.jsx)(e.pre,{tabIndex:"0","data-language":"yaml","data-word-wrap":"",children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'pods/exec'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'create'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]})]})}),"\n",(0,n.jsx)(e.p,{children:"Note: without the full permissions it is possible that the dashboard has some\nissues rendering."}),"\n",(0,n.jsx)(e.h3,{id:s[4].id,children:s[4].value}),"\n",(0,n.jsx)(e.p,{children:"For each supported resource type (nodes, services, pods), you need:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.code,{children:"create"})," for ",(0,n.jsx)(e.code,{children:"resource/proxy"})]}),"\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.code,{children:"get"})," for ",(0,n.jsx)(e.code,{children:"resource"})]}),"\n"]}),"\n",(0,n.jsx)(e.p,{children:"Notes:"}),"\n",(0,n.jsxs)(e.ul,{children:["\n",(0,n.jsxs)(e.li,{children:[(0,n.jsx)(e.code,{children:"resourceNames"})," works for these but it is a little unwieldy for names that are\nauto-generated such as ",(0,n.jsx)(e.code,{children:"node"})," and ",(0,n.jsx)(e.code,{children:"pod"}),"."]}),"\n",(0,n.jsxs)(e.li,{children:["For namespaced resources (",(0,n.jsx)(e.code,{children:"services"}),", ",(0,n.jsx)(e.code,{children:"pods"}),"), this can be a ",(0,n.jsx)(e.code,{children:"RoleBinding"}),"."]}),"\n"]}),"\n",(0,n.jsxs)(e.p,{children:["Hereâs an example role for ",(0,n.jsx)(e.code,{children:"pods"}),":"]}),"\n",(0,n.jsx)(e.pre,{tabIndex:"0","data-language":"yaml","data-word-wrap":"",children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiVersion"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"rbac.authorization.k8s.io/v1"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"kind"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"ClusterRole"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"metadata"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" name"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"my-role"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"rules"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiGroups"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"''"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"pods/proxy"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"create"})]}),"\n",(0,n.jsx)(e.span,{children:(0,n.jsx)(e.span,{style:{"--shiki-light":"#6A737D","--shiki-dark":"#6A737D"},children:" # resourceNames:"})}),"\n",(0,n.jsx)(e.span,{children:(0,n.jsx)(e.span,{style:{"--shiki-light":"#6A737D","--shiki-dark":"#6A737D"},children:" # - my-statefulset-0"})}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiGroups"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"''"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"pods"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"get"})]})]})}),"\n",(0,n.jsx)(e.h3,{id:s[5].id,children:s[5].value}),"\n",(0,n.jsx)(e.p,{children:"The minimum permissions are:"}),"\n",(0,n.jsx)(e.pre,{tabIndex:"0","data-language":"yaml","data-word-wrap":"",children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'services'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:", "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'endpointslices'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"}
1,children:"verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"'patch'"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]})]})}),"\n",(0,n.jsx)(e.h3,{id:s[6].id,children:s[6].value}),"\n",(0,n.jsxs)(e.p,{children:["To support ",(0,n.jsx)(e.code,{children:"scp"}),", the minimum permissions are:"]}),"\n",(0,n.jsx)(e.pre,{tabIndex:"0","data-language":"yaml","data-word-wrap":"",children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiVersion"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"rbac.authorization.k8s.io/v1"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"kind"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"ClusterRole"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"metadata"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" name"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"my-role"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"rules"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiGroups"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"''"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"pods/exec"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"create"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiGroups"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"''"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"pods"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"get"})]})]})}),"\n",(0,n.jsxs)(e.p,{children:["This will allow fetching files directly in addition to listing files that are\npod specific (eg ",(0,n.jsx)(e.code,{children:"/<namespace>/<pod>/<container>"}),")."]}),"\n",(0,n.jsx)(e.p,{children:"To list files at the cluster level, youâll need to add:"}),"\n",(0,n.jsx)(e.pre,{tabIndex:"0","data-language":"yaml","data-word-wrap":"",children:(0,n.jsxs)(e.code,{children:[(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiVersion"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"rbac.authorization.k8s.io/v1"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"kind"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"ClusterRole"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"metadata"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" name"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"my-role"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"rules"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:"apiGroups"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:": ["}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"''"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:"]"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" resources"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"pods"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"namespaces"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#22863A","--shiki-dark":"#85E89D"},children:" verbs"}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:":"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"get"})]}),"\n",(0,n.jsxs)(e.span,{children:[(0,n.jsx)(e.span,{style:{"--shiki-light":"#24292E","--shiki-dark":"#E1E4E8"},children:" - "}),(0,n.jsx)(e.span,{style:{"--shiki-light":"#032F62","--shiki-dark":"#9ECBFF"},children:"list"})]})]})})]})},"/architecture/access-control",{filePath:"pages/architecture/access-control.mdx",timestamp:1727462821e3,pageMap:h.v,frontMatter:{},title:"Access Control"},"undefined"==typeof RemoteContent?d:RemoteContent.useTOC)},38925:function(i,s,e){"use strict";e.d(s,{a:function(){return a}});var n=e(11151),t=e(25675),h=e.n(t),r=e(67294);let l={img:i=>(0,r.createElement)("object"==typeof i.src?h():"img",i)},a=i=>(0,n.a)({...l,...i})},37812:function(i,s,e){"use strict";e.d(s,{c:function(){return d}});var n=e(85893),t=e(3665),h=e(48644);let r=(0,e(67294).createContext)({}),l=r.Provider;r.displayName="SSG";var a=e(38925);function d(i,s,e,n){let h=globalThis[t.ud];return h.route=s,h.pageMap=e.pageMap,h.context[s]={Content:i,pageOpts:e,useTOC:n},c}function c({__nextra_pageMap:i=[],__nextra_dynamic_opts:s,...e}){let r=globalThis[t.ud],{Layout:a,themeConfig:d}=r,{route:c,locale:o}=(0,h.t)(),p=r.context[c];if(!p)throw Error(`No content found for the "${c}" route. Please report it as a bug.`);let{pageOpts:E,useTOC:x,Content:j}=p;if(c.startsWith("/["))E.pageMap=i;else for(let{route:s,children:e}of i){let i=s.split("/").slice(o?2:1);(function i(s,[e,...n]){for(let t of s)if("children"in t&&e===t.name)return n.length?i(t.children,n):t})(E.pageMap,i).children=e}if(s){let{title:i,frontMatter:e}=s;E={...E,title:i,frontMatter:e}}return(0,n.jsx)(a,{themeConfig:d,pageOpts:E,pageProps:e,children:(0,n.jsx)(l,{value:e,children:(0,n.jsx)(k,{useTOC:x,children:(0,n.jsx)(j,{...e})})})})}function k({children:i,useTOC:s}
1){let{wrapper:e}=(0,a.a)();return(0,n.jsx)(o,{useTOC:s,wrapper:e,children:i})}function o({children:i,useTOC:s,wrapper:e,...t}){let h=s(t);return e?(0,n.jsx)(e,{toc:h,children:i}):i}},98757:function(i,s,e){"use strict";e.d(s,{G:function(){return h}});var n=e(85893),t=e(67294);function h({chart:i}){let s=(0,t.useId)(),[h,r]=(0,t.useState)(""),l=(0,t.useRef)(null),a=function(i){let[s,e]=(0,t.useState)(!1);return(0,t.useEffect)(()=>{let s=new IntersectionObserver(([i])=>{i.isIntersecting&&(s.disconnect(),e(!0))});return s.observe(i.current),()=>{s.disconnect()}},[i]),s}(l);return(0,t.useEffect)(()=>{if(!a)return;let n=document.documentElement,t=new MutationObserver(h);return t.observe(n,{attributes:!0}),h(),()=>{t.disconnect()};async function h(){let t=n.classList.contains("dark")||n.attributes.getNamedItem("data-theme")?.value==="dark",{default:h}=await Promise.resolve().then(e.bind(e,42858));try{h.initialize({startOnLoad:!1,securityLevel:"loose",fontFamily:"inherit",themeCSS:"margin: 1.5rem auto 0;",theme:t?"dark":"default"});let{svg:e}=await h.render(s.replaceAll(":",""),i.replaceAll("\\n","\n"),l.current);r(e)}catch(i){console.error("Error while rendering mermaid",i)}}},[i,a]),(0,n.jsx)("div",{ref:l,dangerouslySetInnerHTML:{__html:h}})}},39559:function(i,s,e){"use strict";e.d(s,{v:function(){return h}});var n=e(85893),t=e(80078);let h=[{data:{"*":{theme:{breadcrumb:!1}},blog:{type:"page",title:"Blog",theme:{layout:"raw",typesetting:"article",timestamp:!1,breadcrumb:!0,pagination:!1}},index:{title:"Overview",display:"hidden"},"getting-started":"Getting Started",architecture:"Architecture",legal:{title:"Legal",display:"hidden"}}},{name:"architecture",route:"/architecture",children:[{data:{}},{name:"access-control",route:"/architecture/access-control",frontMatter:{sidebarTitle:"Access Control"}}]},{name:"architecture",route:"/architecture",frontMatter:{sidebarTitle:"Architecture"}},{name:"blog",route:"/blog",children:[{data:{"*":{display:"hidden",theme:{sidebar:!1,timestamp:!0,layout:"default",theme:{typesetting:"article"},topContent:function(){let{frontMatter:i}=(0,t.ZR)(),{title:s,byline:e}=i,h=new Date(i.date);return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)("h1",{className:"text-balance",children:s}),(0,n.jsxs)("div",{className:"text-gray-500 text-center",children:[(0,n.jsx)("time",{dateTime:h.toISOString(),children:h.toLocaleDateString("en",{month:"long",day:"numeric",year:"numeric"})})," ","by ",e]})]})}}}}},{name:"2024-09-19-auth-isnt-hard",route:"/blog/2024-09-19-auth-isnt-hard",frontMatter:{title:"Stop Making Kubernetes Auth Hard",date:new Date(1726704e6),byline:"Thomas Rampelberg"}},{name:"2024-09-30-use-kube-rs",route:"/blog/2024-09-30-use-kube-rs",frontMatter:{title:"Write Your Next Kubernetes Controller in Rust",date:new Date(17276544e5),byline:"Thomas Rampelberg"}}]},{name:"blog",route:"/blog",frontMatter:{sidebarTitle:"Blog"}},{name:"getting-started",route:"/getting-started",frontMatter:{sidebarTitle:"Getting Started"}},{name:"index",route:"/",frontMatter:{sidebarTitle:"Index"}},{name:"installation",route:"/installation",children:[{name:"helm",route:"/installation/helm",frontMatter:{sidebarTitle:"Helm"}}]},{name:"installation",route:"/installation",frontMatter:{sidebarTitle:"Installation"}},{name:"legal",route:"/legal",children:[{data:{privacy:{display:"hidden"},toc:{display:"hidden"}}},{name:"privacy",route:"/legal/privacy",frontMatter:{sidebarTitle:"Privacy"}},{name:"toc",route:"/legal/toc",frontMatter:{sidebarTitle:"Toc"}}]},{name:"legal",route:"/legal",frontMatter:{sidebarTitle:"Legal"}},{name:"operations",route:"/operations",frontMatter:{sidebarTitle:"Operations"}},{name:"usage",route:"/usage",frontMatter:{sidebarTitle:"Usage"}}]}},function(i){i.O(0,[2888,9774,179],function(){return i(i.s=37994)}),_N_E=i.O()}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.