User Access Management for large Enterprises in Kubernetes

Transcript

1. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   WhizUs GmbH Kubernetes Certified Service Provider February 2020
   User Access Management
   for large Enterprises in
   Kubernetes
   Real World Use Case
   

   View Slide

2. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   About
   - Ronald Wimmer
   - Ops Engineer @ÖBB (BCC)
   - Manages tons of Kubernetes
   Clusters everyday
   - Dimitrij Klesev
   - Kubernetes Engineer @WhizUs
   - Supports Ronald in managing tons
   of Kubernetes Clusters everyday
   

   View Slide

3. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   When we setup a k8s cluster, we usually do this
   here
   admin@master:~$ kubeadm init ...
   admin@master:~$ cp /etc/kubernetes/admin.conf
   ~/.kube/config
   For “single cluster few users” setup we’re ok with that
   

   View Slide

4. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   But how do we handle this here?
   Dev Cluster
   Lab Cluster
   GPU Cluster
   Prod Cluster
   Big Hell Hybrid Cluster
   Windows-Subcluster
   

   View Slide

5. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   Only admin.conf is not really an option sometimes…
   Especially if one has more users (so different permissions)
   Project
   Dev Ops QA
   Team A Team B
   

   View Slide

6. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   Only admin.conf is not really an option sometimes…
   Or there are different independent projects
   Happy Devs
   Project A Project B Project N
   Especially if one has more users (so different permissions)
   

   View Slide

7. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   Only admin.conf is not really an option sometimes…
   Especially if one has more users (so different permissions)
   Or there are different independent projects
   But the main point here is….
   … ONE has to manage all of this somehow!
   

   View Slide

8. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   What about LDAP?
   

   View Slide

9. WhizUs GmbH Kubernetes Certified Service Provider February 2020
   Most companies have different hierarchies
   Holding
   Company A Company B
   Dep. A Dep. B Dep. C
   Dev A Dev B You know, flat hierarchies….
   

   View Slide

10. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Most companies have different hierarchies
    So it’s quite common that there will or could be some
    form of Directory Service
    Some common ones:
    - Active Directory (Azure)
    - Red Hat Directory Server
    - Or “LDAP” in general
    

    View Slide

11. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Kubernetes supports different types of authn
    LDAP, however, is not supported
    But OpenID Connect is supported
    

    View Slide

12. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Let’s look into the Docs
    

    View Slide

13. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Source: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens
    

    View Slide

14. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    As Identity Provider we’ll use Keycloak
    The IdP will be connected to the Directory Service by using
    LDAP
    Note: we’re not talking about authz yet
    

    View Slide

15. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    DEMO
    

    View Slide

16. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    What about authz?
    

    View Slide

17. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Kubernetes supports such things like
    - Node (special for kubelets)
    Usually one uses RBAC
    - RBAC (most commonly used)
    - ABAC (more advanced, but more complicated)
    - Webhook (using external systems)
    

    View Slide

18. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Source: https://www.cncf.io/blog/2018/08/01/demystifying-rbac-in-kubernetes/
    

    View Slide

19. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    pod-read-create, cluster-read-only,
    watch-all-ingresses, a.s.o…. (just few examples)
    Without using meaningful patterns things could
    become cumbersome
    How to manage authz (with RBAC) in a reasonable
    way without going crazy?
    

    View Slide

20. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    What about LDAP?
    (again)
    

    View Slide

21. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    We remember:
    “Especially if one has more users (so different permissions)”
    Project
    Dev Ops QA
    Team A Team B
    

    View Slide

22. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    We remember:
    What about this (Note: this is not always a solution!)
    Project
    Dev Ops QA
    Team A Team B
    Cluster A Cluster B Cluster N
    Namespace A Namespace B
    

    View Slide

23. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    We can use groups with their hierarchies from LDAP
    and map this to our RBAC!
    [customer]_project_[cluster]_[namespace]_[...]_role
    * [ ] means optional
    oebb_k8s_cluster-admin
    oebb_k8s_dev_demo_read-only
    

    View Slide

24. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    kind: RoleBinding
    apiVersion: rbac.authorization.k8s.io/v1
    metadata:
    name: oidc-demo_read-only
    namespace: demo
    roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: view
    subjects:
    - kind: Group
    name: /oebb_k8s_dev_demo_read-only
    

    View Slide

25. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    DEMO
    

    View Slide

26. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Thank You!
    

    View Slide

27. WhizUs GmbH Kubernetes Certified Service Provider February 2020
    Additional Info
    https://github.com/whizus
    https://speakerdeck.com/dklesev
    https://kubernetes.io/docs/reference/access-authn-authz/authentication/
    https://www.freeipa.org/
    https://www.keycloak.org/
    https://blog.lithnet.io/2018/03/the-ldap-authentication-anti-pattern.html
    

    View Slide