Docker/portainer
Docker/portainer
1
0
Fork 0
mirror of https://github.com/portainer/portainer.git synced 2025-08-02 20:35:25 +02:00
Code Issues Releases Activity

feat(rbac): detect if rbac is enabled [EE-4308] (#8139)

Browse source
This commit is contained in:
Ali 2022-12-07 15:53:06 +13:00 • committed by GitHub
parent 8dcc5e4adb
commit c1cc8bad77
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
10 changed files with 327 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

39
app/kubernetes/views/configure/configure.html
View file

@ -118,6 +118,29 @@
<!-- #region SECURITY -->
<div class="col-sm-12 form-section-title"> Security </div>
<div
ng-if="!ctrl.isRBACEnabled"
class="mt-1 mb-6 p-4 w-full border border-solid bg-warning-2 border-warning-5 text-warning-8 th-dark:bg-yellow-11 th-dark:text-white th-highcontrast:bg-yellow-11 th-highcontrast:text-white small flex gap-1 rounded-lg"
>
<div class="mt-0.5">
<pr-icon icon="'alert-triangle'" feather="true" class-name="'text-warning-7 th-dark:text-white th-highcontrast:text-white'"></pr-icon>
</div>
<div>
<p> Your cluster does not have Kubernetes role-based access control (RBAC) enabled. </p>
<p> This means you can't use Portainer RBAC functionality to regulate access to environment resources based on user roles. </p>
<p class="mb-0">
To enable RBAC, start the&nbsp;<a
class="th-dark:text-blue-7 th-highcontrast:text-blue-4"
href="https://kubernetes.io/docs/concepts/overview/components/#kube-apiserver"
target="_blank"
>API server</a
>&nbsp;with the&nbsp;<code class="box-decoration-clone bg-gray-4 th-dark:bg-black th-highcontrast:bg-black">--authorization-mode</code>&nbsp;flag set to a
comma-separated list that includes&nbsp;<code class="bg-gray-4 th-dark:bg-black th-highcontrast:bg-black">RBAC</code>, for example:&nbsp;
<code class="box-decoration-clone bg-gray-4 th-dark:bg-black th-highcontrast:bg-black">kube-apiserver --authorization-mode=Example1,RBAC,Example2</code>.
</p>
</div>
</div>
<div class="form-group">
<span class="col-sm-12 text-muted small">
By default, all the users have access to the default namespace. Enable this option to set accesses on the default namespace.
@ -126,10 +149,17 @@
<div class="form-group">
<div class="col-sm-12">
<label class="control-label text-left col-sm-5 col-lg-4 px-0"> Restrict access to the default namespace </label>
<label class="switch col-sm-8">
<input type="checkbox" ng-model="ctrl.formValues.RestrictDefaultNamespace" /><span class="slider round" data-cy="kubeSetup-restrictDefaultNsToggle"></span>
</label>
<por-switch-field
checked="ctrl.formValues.RestrictDefaultNamespace"
name="'restrictDefaultNs'"
label="'Restrict access to the default namespace'"
on-change="(ctrl.onToggleRestrictNs)"
label-class="'col-sm-5 col-lg-4 px-0 !m-0'"
switch-class="'col-sm-8 text-muted'"
data-cy="kubeSetup-restrictDefaultNsToggle"
disabled="!ctrl.isRBACEnabled"
>
</por-switch-field>
</div>
<div class="col-sm-12 mt-5">
@ -141,6 +171,7 @@
switch-class="'col-sm-8 text-muted'"
data-cy="kubeSetup-restrictStandardUserIngressWToggle"
feature-id="ctrl.limitedFeatureIngressDeploy"
disabled="!ctrl.isRBACEnabled"
></por-switch-field>
</div>
</div>

17
app/kubernetes/views/configure/configureController.js
View file

@ -7,6 +7,7 @@ import KubernetesNamespaceHelper from 'Kubernetes/helpers/namespaceHelper';
import { FeatureId } from '@/react/portainer/feature-flags/enums';
import { getIngressControllerClassMap, updateIngressControllerClassMap } from '@/react/kubernetes/cluster/ingressClass/utils';
import { getIsRBACEnabled } from '@/react/kubernetes/cluster/service';
class KubernetesConfigureController {
/* #region CONSTRUCTOR */
@ -54,6 +55,7 @@ class KubernetesConfigureController {
this.onToggleIngressAvailabilityPerNamespace = this.onToggleIngressAvailabilityPerNamespace.bind(this);
this.onToggleAllowNoneIngressClass = this.onToggleAllowNoneIngressClass.bind(this);
this.onChangeStorageClassAccessMode = this.onChangeStorageClassAccessMode.bind(this);
this.onToggleRestrictNs = this.onToggleRestrictNs.bind(this);
}
/* #endregion */
@ -261,6 +263,12 @@ class KubernetesConfigureController {
});
}
onToggleRestrictNs() {
this.$scope.$evalAsync(() => {
this.formValues.RestrictDefaultNamespace = !this.formValues.RestrictDefaultNamespace;
});
}
/* #region ON INIT */
async onInit() {
this.state = {
@ -292,11 +300,18 @@ class KubernetesConfigureController {
IngressAvailabilityPerNamespace: false,
};
// default to true if error is thrown
this.isRBACEnabled = true;
this.isIngressControllersLoading = true;
try {
this.availableAccessModes = new KubernetesStorageClassAccessPolicies();
[this.StorageClasses, this.endpoint] = await Promise.all([this.KubernetesStorageService.get(this.state.endpointId), this.EndpointService.endpoint(this.state.endpointId)]);
[this.StorageClasses, this.endpoint, this.isRBACEnabled] = await Promise.all([
this.KubernetesStorageService.get(this.state.endpointId),
this.EndpointService.endpoint(this.state.endpointId),
getIsRBACEnabled(this.state.endpointId),
]);
this.ingressControllers = await getIngressControllerClassMap({ environmentId: this.state.endpointId });
this.originalIngressControllers = structuredClone(this.ingressControllers) || [];