KOP - Custom ZTKA - Rafay Product Documentation
Overview
Overview
The base roles that the platform includes out of the box provides a certain level of access to controller and cluster resources, the details of which are outlined here.
There are scenarios where more fine-grained access policies (than what is included with the platform's base roles) need to be configured for users. ZTKA (Zero-Trust) Custom Access enables customers to define custom RBAC definitions to control the access that users have to the clusters in the organization.
An example could be restricting users to read only access (get, list, watch verbs) for certain resources (e.g. pods, secrets) in a certain namespace. Only Org Admin can configure ZTKA Custom Access rules, policies, and custom roles.
Implementing ZTKA Custom Access
ZTKA Custom Access implementation involves the following three steps:
Step 1 - Create Rules: ClusterRole or Role YAML definition files are provided as part of this step, applicability of the rule is determined based on project/cluster selection
Step 2 - Create Policies: Policies is a collection of one or more rules that is referenced as part of Custom Roles
Step 3 - Custom Roles: A Custom Role configuration includes selection of a base role along with the necessary overlay ZTKA Custom Access policies
Important
Custom ZTKA Access definition specified for a user for a particular project/cluster overrides the ZTKA Access definition associated with the user's base role.
Scenarios
| Platform Base Role | K8s Role | K8s RoleBindings |
|---|---|---|
| Workspace/Namespace Admin or Workspace/Namespace Read Only | ClusterRole and the YAML file includes the label k8smgmt.io/bindingtype: rolebinding | RoleBindings will be created in all the namespaces associated with the base role |
| Platform Base Roles other than Workspace/Namespace Admin and Workspace/Namespace Read Only | ClusterRole and the YAML file includes the label k8smgmt.io/bindingtype: rolebinding | ClusterRoleBindings will be created |
| Any Platform Base Role | ClusterRole | ClusterRoleBindings will be created |
| Any Platform Base Role | Role | RoleBindings will be created in the namespaces provided in the Role Definition file |
ZTKA Custom Access workflow
The sequence diagram below captures the high level steps to create a Rules, Policies, and Custom Roles.
Step 1: ZTKA Custom Access Rules
New VersionSave ChangesAdd RulesNavigate to ZTKA Custom Access RulesLogin to ConsoleNew VersionSave ChangesAdd RulesNavigate to ZTKA Custom Access RulesLogin to ConsoleOnly Org AdminFrom System menuCreate new rule versionSettings: Artifact File, Project Selector, and Cluster SelectorEdit to add multiple versions
Step 2: ZTKA Custom Access Policies
New VersionSave ChangesAdd PolicyNavigate to ZTKA Custom Access PoliciesNew VersionSave ChangesAdd PolicyNavigate to ZTKA Custom Access PoliciesCreate new policy versionSettings: General and ZTKA RulesEdit to add multiple versions
Step 3: Custom Roles
Save ChangesAdd RoleNavigate to Custom RolesSave ChangesAdd RoleNavigate to Custom RolesCreate new roleSettings: Name, Base Role, and ZTKA Policies