docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fixed file name typo

This commit is contained in:
ddeyo 2018-09-07 13:38:01 -07:00
parent ee09926e6b
commit 4981841804
1 changed files with 73 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

73
ee/ucp/authorization/configure-rbac-kube.md Normal file
View File

@ -0,0 +1,73 @@
---
title: Enable Kuberenetes RBAC
description: Learn how configure role-based access control for Kubernetes
keywords: Kuberenetes, ucp, RBAC
redirects: /ee/ucp/authorization/migrate-kubernetes-roles/
---
UCP 3.0 used its own role-based asccess control (RBAC) for Kubernetes clusters. New in UCP 3.1 is the ability to use Kubernetes RBAC. The benefits of doing this are:
- Many ecosystem applications and integrations expect Kubernetes RBAC as a part of their YAML files to provide access to service accounts.
- Organizations planning to run UCP both on-premesis as well as in hosted cloud services want to run Kubernetes applications on both sets of environments, without manually changing RBAC for their YAML file.
Kubernetes RBAC is turned on by default for Kubernetes clusters when customers upgrade to UCP 3.1. See [RBAC authorization in Kubernetes](https://v1-8.docs.kubernetes.io/docs/admin/authorization/rbac/) for more information about Kubernetes role-based access control.
Starting with UCP 3.1, Kubernetes & Swarm roles have separate views. You can view all the roles for a particular cluster under **Access Control** then **Roles**. Select Kubernetes or Swarm to view the specific roles for each.
## Creating roles
You create Kubernetes roles either through the CLI using `kubectl` or through the UCP web interface.
To create a Kuberenetes role in the UCP web interface:
1. Go to the UCP web UI.
2. Navigate to the **Access Control**.
3. In the lefthand menu, select **Roles**.
![Kubernetes Grants in UCP](../images/kube-rbac-roles.png)
4. Select the **Kubernetes** tab at the top of the window.
5. Select **Create** to create a Kubernetes role object in the following dialog:
![Kubernetes Role Creation in UCP](../images/kube-role-create.png)
6. Select a namespace from the **Namespace** dropdown list. Selecting a specific namespace creates a role for use in that namespace, but selecting all namespaces creates a `ClusterRole` where you can create rules for cluster-scoped Kubernetes resources as well as namespaced resources.
7. Provide the YAML for the role, either by entering it in the **Object YAML** editor or select **Click to upload a .yml file** to choose and upload a .yml file instead.
8. When you have finished specifying the YAML, Select **Create** to complete role creation.
## Creating role grants
Kubernetes provides 2 types of role grants:
- `ClusterRoleBinding` which applies to all namespaces
- `RoleBinding` which applies to a specific namespace
To create a grant for a Kuberenetes role in the UCP web interface:
1. Go to the UCP web UI.
2. Navigate to the **Access Control**.
3. In the lefthand menu, select **Grants**.
![Kubernetes Grants in UCP](../images/kube-rbac-grants.png)
4. Select the **Kubernetes** tab at the top of the window. All grants to Kubernetes roles can be viewed in the Kubernetes tab.
5. Select **Create New Grant** to start the Create Role Binding wizard and create a new grant for a given user, team or service.
![Kubernetes Create Role Binding in UCP](../images/kube-grant-wizard.png)
6. Select the subject type. Your choices are:
- **All Users**
- **Organizations**
- **Service account**
7. To create a user role binding, select a username from the **Users** dropdown list then select **Next**.
8. Select a resource set for the subject. The **default** namespace is automatically selected. To use a different namespace, select the **Select Namespace** button next to the desired namespace. For `Cluster Role Binding`, slide the **Apply Role Binding to all namespaces** selector to the right.
![Kubernetes Create User Role Binding in UCP](../images/kube-grant-rolebinding.png)
9. Select **Next** to continue.
10. Select the **Cluster Role** from the dropdown list. If you create a `ClusterRoleBinding` (by selecting **Apply Role Binding to all namespaces**) then you may only select ClusterRoles. If you select a specific namespace, you can choose any role from that namespace or any ClusterRole.
![Kubernetes Select Cluster Role in UCP](../images/kube-grant-roleselect.png)
11. Select **Create** to complete creating the grant.