RBAC Reference

For facilitating role-based access for users, Veeam Kasten leverages Kubernetes ClusterRoles and Bindings. Currently, the Veeam Kasten Multi-Cluster global manager is only available to admin users and requires additional RBAC roles and bindings.

Multi-Cluster Admin

The k10-mc-admin ClusterRole is added for Distributions, Clusters, Config, Secrets and Multi-Cluster RBAC configuration access in the Veeam Kasten Multi-Cluster namespace.

Note

k10-mc-admin will be installed under the name <release_name>-mc-admin. This ClusterRole is not configurable and is installed with Veeam Kasten.

The following is an example of the k10-mc-admin ClusterRole:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k10-mc-admin
rules:
- apiGroups:
  - config.kio.kasten.io
  - dist.kio.kasten.io
  - auth.kio.kasten.io
  resources:
  - '*'
  verbs:
  - '*'
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - '*'

Multi-Cluster Admin Binding

The k10-mc-admin ClusterRole needs a RoleBinding in the Veeam Kasten Multi-Cluster namespace.

Veeam Kasten creates a RoleBinding for a default Group k10:admins in the Veeam Kasten Multi-Cluster namespace. Admin users can be added to this Group and will be able to use the above k10-mc-admin ClusterRole.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: k10-k10-mc-admin
  namespace: kasten-io-mc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k10-mc-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: k10:admins

To bind the k10-mc-admin ClusterRole to a User, use the following command

$ kubectl create rolebinding <name> --clusterrole=k10-mc-admin \
    --namespace=kasten-io-mc \
    --user=<name>

The above kubectl command will create the following RoleBinding object

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: k10-k10-mc-admin
  namespace: kasten-io-mc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k10-mc-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: k10-mc-admin

Alternatively, you can also bind the ClusterRole to a ServiceAccount.

$ kubectl create rolebinding <name> --clusterrole=k10-mc-admin \
    --namespace=kasten-io-mc \
    --serviceaccount=<serviceaccount_namespace>:<serviceaccount_name>

The above kubectl command will create the following RoleBinding object

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: k10-k10-mc-admin
  namespace: kasten-io-mc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: k10-mc-admin
subjects:
- kind: ServiceAccount
  name: k10-mc-admin
  namespace: kasten-io-mc

Multi-Cluster User

For non-admin users of Veeam Kasten Multi-Cluster Manager, admins can allow cluster-level access, without giving access to configuration or admin-only operations.

The following rules can be applied to any existing user's ClusterRole or a new ClusterRole can be created.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: k10-mc-user
rules:
- apiGroups:
  - auth.kio.kasten.io
  - config.kio.kasten.io
  - dist.kio.kasten.io
  resources:
  - '*'
  verbs:
  - get
  - list

Note

Above ClusterRole will give access to ALL clusters, for a more granular access, use resourceNames option.

To bind the k10-mc-user ClusterRole to a User, use the following command

$ kubectl create rolebinding <name> --clusterrole=k10-mc-user \
    --namespace=kasten-io-mc \
    --user=<name>

To bind the k10-mc-user ClusterRole to a ServiceAccount, use the following command

$ kubectl create rolebinding <name> --clusterrole=k10-mc-user \
    --namespace=kasten-io-mc \
    --serviceaccount=<serviceaccount_namespace>:<serviceaccount_name>

Multi-Cluster User Binding

Once users are bound to clusters using the cluster role or rules defined above, a K10ClusterRoleBinding is required to define the level of access within the clusters.

K10ClusterRoles

These are pre-defined K10ClusterRoles already installed with K10. k10-multi-cluster-admin K10ClusterRole has access defined in k10-admin ClusterRole, k10-multi-cluster-basic K10ClusterRole has access defined in k10-basic ClusterRole, and k10-multi-cluster-config-view K10ClusterRole has access defined in k10-config-view ClusterRole. More about k10-admin, k10-basic, and k10-config-view can be found at K10 RBAC.

K10ClusterRoleBindings

K10ClusterRoleBindings are used for defining who (users/groups) have what (K10ClusterRole) access in which clusters. They are Custom Resources that can be created in the primary cluster to give users/groups access to all or some secondary clusters.

K10 is installed with three pre-defined K10ClusterRoles that correspond to k10-admin, k10-basic and k10-config-view ClusterRoles.

The following example illustrates how to create a K10ClusterRoleBinding for user user1, using k10-multi-cluster-admin K10ClusterRole, for cluster cluster1.

$ cat > sample-k10ClusterRoleBinding.yaml <<EOF
apiVersion: auth.kio.kasten.io/v1alpha1
kind: K10ClusterRoleBinding
metadata:
  name: user1-cluster1
  namespace: kasten-io-mc
spec:
  k10ClusterRole: k10-multi-cluster-admin
  clusters:
   - name: cluster1
  subjects:
   - kind: User
     apiGroup: rbac.authorization.k8s.io
     name: user1
EOF

$ kubectl create -f sample-k10ClusterRoleBinding.yaml
k10clusterrolebinding.auth.kio.kasten.io/user1-cluster1 created

For service account users, a prefix of system:serviceaccount:<sa_namespace>: is needed for adding such users.

The following example illustrates how to create a K10ClusterRoleBinding for user sa1, using k10-multi-cluster-admin K10ClusterRole, for cluster cluster1.

$ cat > sample-k10ClusterRoleBinding.yaml <<EOF
apiVersion: auth.kio.kasten.io/v1alpha1
kind: K10ClusterRoleBinding
metadata:
  name: sa1-cluster1
  namespace: kasten-io-mc
spec:
  k10ClusterRole: k10-multi-cluster-admin
  clusters:
   - name: cluster1
  subjects:
   - kind: User
     apiGroup: rbac.authorization.k8s.io
     name:  system:serviceaccount:sa_namespace:sa1
EOF

$ kubectl create -f sample-k10ClusterRoleBinding.yaml
k10clusterrolebinding.auth.kio.kasten.io/sa1-cluster1 created

K10ClusterRoleBindings API Type

The following is a complete specification of the K10ClusterRoleBinding API.

# Standard Kubernetes API Version declaration. Required.
apiVersion: auth.kio.kasten.io/v1alpha1
# Standard Kubernetes Kind declaration. Required.
kind: K10ClusterRoleBinding
metadata:
  # K10ClusterRoleBinding name. May be any valid Kubernetes object name. Required.
  # K10ClusterRoleBinding name is not mutable once created.
  name: k10ClusterRoleBinding-example
  # K10ClusterRoleBinding names must be unique and as an alternative to name above
  # one can take advantage of Kubernetes auto name generation
  generateName: k10ClusterRoleBinding-
  # K10ClusterRoleBinding namespace. Required.
  # Must be the Multi-Cluster namespaces
  namespace: kasten-io-mc
# K10ClusterRoleBinding spec. Required.
spec:
  # k10ClusterRole name. Required
  # Choose from existing k10ClusterRoles in the system.
  # Can be oneOf k10-multi-cluster-admin, k10-multi-cluster-basic, k10-multi-cluster-config-view
  k10ClusterRole: k10-multi-cluster-admin
  # List of cluster selectors. Required.
  # Either name or selector must be specified. To select all clusters, an
  # empty selector may be used.
  clusters:
   - name: <cluster_name> # cluster1
   - selector: <selector_string> # "foo=bar"
  # List of subjects. Required.
  # Either a user or groups
  subjects:
   - kind: User
     apiGroup: rbac.authorization.k8s.io
     name: user1
   - kind: Groups
     apiGroup: rbac.authorization.k8s.io
     name: group1