Learn KOP - Create Isolation Boundaries for dedicated clusters - Rafay Product Documentation

Project based isolation

What Will You Do

In this part of the self-paced exercise, we will focus on the following use case:

Teams have dedicated clusters assigned to them. Platform teams want to manage these clusters centrally and ensure that teams only have access to their respective clusters.

For this example, we will consider two teams, alpha and beta each having their dedicated clusters, alpha-cluster and beta-cluster respectively.

Steps:
Step 1: Create projects for each business unit/application (e.g. alpha & beta)
Step 2: Create cluster entries within respective projects and download bootstrap
Step 3: Apply bootstrap to the clusters to initiate the import process
Step 4: Verify that the clusters are imported to the right projects and are healthy
Step 5: Create "project specific roles" for users in alpha/beta teams and verify access

Declarative specifications are also provided for this exercise.

Step 1: Create projects for alpha and beta teams

Login into your Org as an Org Admin
Click on New Project
Provide the name for the project (e.g. alpha) and a suitable description
Click Create
Repeat the same exercise and create another project for team beta

Step 2: Create cluster entries, download bootstrap

Navigate to project alpha
Click on New Cluster
Select Import Existing Kubernetes Cluster
Click Continue
Select Environment and Kubernetes Distribution as appropriate
Provide a cluster name (e.g. alpha-cluster) and description as needed
Click Continue
For this example, we will keep the Blueprint selection as minimal, click Continue
Download the cryptographically unique bootstrap YAML required to register the cluster

Step 3: Apply bootstrap to initiate the import process

Use kubectl to apply the "cluster bootstrap" file on your K8s cluster.

kubectl apply -f  [path to file]/alpha-cluster-bootstrap.yaml

This will create a namespace for the k8s mgmt operator, download the container images, and register with the controller. This one time import process can take ~2 minutes.

namespace/rafay-system created
serviceaccount/system-sa created
clusterrole.rbac.authorization.k8s.io/rafay:manager created
clusterrolebinding.rbac.authorization.k8s.io/rafay:rafay-system:manager-rolebinding created
clusterrole.rbac.authorization.k8s.io/rafay:proxy-role created
clusterrolebinding.rbac.authorization.k8s.io/rafay:rafay-system:proxy-rolebinding created
priorityclass.scheduling.k8s.io/rafay-cluster-critical created
role.rbac.authorization.k8s.io/rafay:leader-election-role created
rolebinding.rbac.authorization.k8s.io/rafay:leader-election-rolebinding created
customresourcedefinition.apiextensions.k8s.io/namespaces.cluster.rafay.dev created
customresourcedefinition.apiextensions.k8s.io/tasklets.cluster.rafay.dev created
customresourcedefinition.apiextensions.k8s.io/tasks.cluster.rafay.dev created
service/controller-manager-metrics-service-v3 created
deployment.apps/controller-manager-v3 created
configmap/connector-config-v3 created
configmap/proxy-config-v3 created
deployment.apps/rafay-connector-v3 created
service/rafay-drift-v3 created
validatingwebhookconfiguration.admissionregistration.k8s.io/rafay-drift-validate-v3 created

Repeat Steps (3) and (4) with Project "beta" and cluster "beta-cluster".

Step 4: Verify that the clusters are imported to the right projects

On the console, you will notice that the imported cluster would have registered itself and will start receiving instructions from the controller. You can also check the status of the mgmt operator pods on your cluster using kubectl.

kubectl get po -n rafay-system

You should see something like

NAME                                     READY   STATUS    RESTARTS   AGE
controller-manager-v3-66dfbd5db4-v97vw   1/1     Running   0          68s
edge-client-84499dfdd4-qn67q             1/1     Running   0          71s
rafay-connector-v3-7fb99b5cd9-clh2g      1/1     Running   0          68s
relay-agent-556c86f7bc-chxk8             1/1     Running   0          2m49s

Once the k8s operator is operational, it will "establish and maintain a heartbeat" with the controller.

Step 5: Create "project specific roles" for users

Navigate to System -> Users
Click on New User
Input appropriate details (do not add any groups as yet)
Click Save & Exit
You will see a pop-up stating that the user has not been assigned to any groups. Select Yes to continue
Select the user that was just created
Click on the Projects tab
Select Assign User To Project
Select alpha project from the dropdown on the left
Select the Project Admin role or Infra Admin role
Click Save & Exit
Log out of the console now and log in as the user that was created
You can now notice that the user only has access to alpha project and cannot view project beta (and the resources in project beta)

Recap

Congratulations! At this point, you have successfully leveraged "Projects" to achieve isolation between clusters belonging to two different teams.

Declarative project creation

You can alternatively create projects by using the declarative spec. For more information on automation via RCTL CLI, refer to the documentation.

apiVersion: system.k8smgmt.io/v3
kind: Project
metadata:
  description: self-contained unit for team alpha
  name: alpha
spec:
  default: false

Type the command below to create project alpha

rctl apply -f <path-to-filename>.yaml

Repeat the same exercise and create another project for team beta