feat(t8s-cluster): add rbac for teuto staff#1498
Conversation
This allows the staff users to use OIDC kubeconfigs instead of the admin-conf
WalkthroughA new JWT claim mapping for "groups" is added to the authentication configuration, prefixing each group with "teuto.net:". Additionally, a Helm template is introduced to create a ClusterRoleBinding that grants the "teuto.net:staff" group cluster-admin privileges in the workload cluster. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant API Server
participant JWT Auth
participant Kubernetes RBAC
User->>API Server: Authenticate with JWT (groups claim)
API Server->>JWT Auth: Map "groups" claim (prefix with "teuto.net:")
API Server->>Kubernetes RBAC: Authorize access for "teuto.net:staff"
Kubernetes RBAC-->>API Server: Grant cluster-admin if in "teuto.net:staff"
API Server-->>User: Access granted/denied
Suggested labels
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR adds RBAC support for Teuto staff by granting them access via OIDC group mappings instead of the admin kubeconfig.
- Introduces a ClusterRoleBinding for the
teuto.net:staffgroup - Extends the authenticationConfig to map OIDC claim groups into Kubernetes groups
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml | Defines a ClusterRoleBinding named teuto-staff for the staff group |
| charts/t8s-cluster/templates/management-cluster/clusterClass/_authenticationConfig.yaml | Adds a groups claim mapping using dyn(claims.groups) |
Comments suppressed due to low confidence (2)
charts/t8s-cluster/templates/management-cluster/clusterClass/_authenticationConfig.yaml:13
- There’s no test coverage for the new group mapping logic; consider adding unit or integration tests to verify that
claims.groupsis correctly mapped to the expected Kubernetes group names.
expression: dyn(claims.groups).map(g, "teuto.net:" + g)
charts/t8s-cluster/templates/management-cluster/clusterClass/_authenticationConfig.yaml:12
- [nitpick] It may help to add a brief comment explaining the use of
dyn()and the mapping expression to clarify how OIDC claim groups are transformed into Kubernetes groups.
groups:
🤖 I have diffed this beep boop"/$namespace/$kind/$name.yaml" for normal resources
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml (1)
3-15: Explicitly specifyapiGroupin subject and review privilege scope: To avoid ambiguity, addapiGroup: rbac.authorization.k8s.iounder theGroupsubject. Also, grantingcluster-adminis extremely permissive—verify this aligns with your security policy for theteuto.net:staffgroup:subjects: - kind: Group apiGroup: rbac.authorization.k8s.io name: teuto.net:staff
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
charts/t8s-cluster/templates/management-cluster/clusterClass/_authenticationConfig.yaml(1 hunks)charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
🔇 Additional comments (2)
charts/t8s-cluster/templates/management-cluster/clusterClass/_authenticationConfig.yaml (1)
12-13: Confirm groups claim mapping compatibility and defaulting: Good addition to prefix Teuto groups. Ensure your Helm/Sprig version supports thedynandmapfunctions. Consider safeguarding against missingclaims.groupsby defaulting to an empty list:expression: (dyn(claims.groups) | default([])).map(g, "teuto.net:" + g)charts/t8s-cluster/templates/workload-cluster/rbac/teuto-clusterrolebinding.yaml (1)
1-1: Check resource naming consistency in helper invocation: TheresourceIntoClustercall uses"teuto-rbac"as the name, but the actualmetadata.namein the rendered ClusterRoleBinding isteuto-staff. Confirm this discrepancy is intentional and that the helper correctly applies the intended manifest name.🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 1-1: syntax error: expected the node content, but found '-'
(syntax)
🤖 I have created a release *beep* *boop* --- ## [9.3.0](t8s-cluster-v9.2.1...t8s-cluster-v9.3.0) (2025-06-06) ### Features * **t8s-cluster:** add rbac for teuto staff ([#1498](#1498)) ([9e0a9e2](9e0a9e2)) * **t8s-cluster:** enable audit logging ([#1440](#1440)) ([dcb28ca](dcb28ca)) * **t8s-cluster:** make apiserver resources configurable ([#1485](#1485)) ([3126661](3126661)) * **t8s-cluster:** use new pullPolicy template ([#1383](#1383)) ([6b253bd](6b253bd)) ### Miscellaneous Chores * **t8s-cluster:** pin versions ([#1482](#1482)) ([372c92b](372c92b)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Added RBAC for Teuto staff. - Enabled audit logging. - Made apiserver resource configurations customizable. - Adopted a new pullPolicy template. - **Enhancements** - Updated OpenStack Cinder CSI plugin and related CSI component images to newer versions. - Improved documentation for control plane resource configuration and security group rule options. - **Chores** - Updated chart version to 9.3.0 and pinned image versions. - Switched CSI image references and license entries from k8s.gcr.io to registry.k8s.io. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: github-actions <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Chris Werner Rau <cwr@teuto.net>
This allows the staff users to use OIDC kubeconfigs instead of the admin-conf
Summary by CodeRabbit