Chapter 3. Configuring RBAC settings When you install Cryostat 3.0 by using either the Cryostat Operator or a Helm chart, Cryostat includes a reverse proxy ( openshift-oauth-proxy or oauth2_proxy ) in the pod. All API requests to Cryostat and all users of the Cryostat web console or Grafana dashboard are directed through this proxy, which handles client sessions to control access to the application. When deployed on Red Hat OpenShift, the proxy uses the Cryostat installation namespace to perform RBAC checks for user authentication and authorization by integrating with the Red Hat OpenShift cluster SSO provider. From Cryostat 3.0 onward, Cryostat applies the same role-based access control (RBAC) permission check to all users for the purpose of permitting or denying access to the product. By default, the required RBAC role in the Cryostat application's installation namespace is create pods/exec . Any Red Hat OpenShift user accounts that are assigned the required RBAC role have full access to the Cryostat web console and all Cryostat features. If a Red Hat OpenShift account does not have the required RBAC role, this user is blocked from accessing Cryostat. Note You can optionally configure the auth proxy with an htpasswd file to enable Basic authentication. On Red Hat OpenShift, this enables you to define additional user accounts that can access Cryostat beyond those with Red Hat OpenShift SSO RBAC access. When installing a Cryostat instance by using the Cryostat Operator, you can optionally use the .spec.authorizationOptions.openShiftSSO.accessReview field in the Cryostat custom resource (CR) to customize the required Red Hat OpenShift SSO RBAC permissions for accessing Cryostat. Prerequisites Logged in to the OpenShift Container Platform by using the Red Hat OpenShift web console. Procedure If you want to start creating a Cryostat instance, perform the following steps: On your Red Hat OpenShift web console, click Operators > Installed Operators . From the list of available Operators, select Red Hat build of Cryostat. On the Operator details page, click the Details tab. In the Provided APIs section, select Cryostat and then click Create instance . On the Create Cryostat panel, to customize the required SubjectAccessReview or TokenAccessReview for all client access to Cryostat, choose one of the following options: If you are using the Form view: Click the Form view radio button. To open additional options, expand Advanced Configurations to open additional options. Expand the Authorization Options > OpenShift SSO > Access Review section of the Cryostat CR. Figure 3.1. Access Review properties for a Cryostat instance Use the following fields to specify any customized RBAC settings that are required for accessing Cryostat: Field Details group API group of the resource. A wilcard asterisk ( * ) value represents all groups. name Name of the resource being requested for a get or deleted for a delete . An empty value represents all names. namespace Namespace of the action being requested. Currently, there is no distinction between no namespace and all namespaces. Consider the following guidelines: An empty value is defaulted for LocalSubjectAccessReviews. An empty value represents no cluster-scoped resources. An empty value represents all namespace-scoped resources from a SubjectAccessReview or SelfSubjectAccessReview. resource An existing resource type. A wildcard asterisk ( * ) value represents all resource types. subresource An existing resource type. An empty value represents no resource types. verb A Kubernetes resource API verb (for example, get , list , watch , create , update , delete , proxy ). A wildcard asterisk ( * ) value represents all verbs. version API version of the resource. A wildcard asterisk ( * ) value represents all versions. If you are using the YAML view: Click the YAML view radio button. From the spec: element, edit the authorizationOptions:OpenShiftSSO properties to match your RBAC permission requirements. Example configuration for RBAC permissions apiVersion: operator.cryostat.io/v1beta2 kind: Cryostat metadata: name: cryostat-sample namespace: cryostat-test spec: ... authorizationOptions: openShiftSSO: accessReview: group: <API group of resource> name: <Name of resource being requested or deleted> namespace: <Namespace of action being requested> resource: <An existing resource type> subresource: <An existig resource type> verb: <A Kubernetes resource API verb> version: <API version of resource> ... If you want to configure other properties in the custom resource (CR) for this Cryostat instance, see the other sections of this document for more information about these properties. If you want to finish creating this Cryostat instance, click Create . When you click Create , this Cryostat instance is available under the Cryostat tab on the Operator details page. You can subsequently edit the CR properties for a Cryostat instance by clicking the instance name on the Operator details page and then select Edit Cryostat from the Actions drop-down menu. Revised on 2024-07-02 13:37:27 UTC

Commands:
apiVersion: operator.cryostat.io/v1beta2 kind: Cryostat metadata: name: cryostat-sample namespace: cryostat-test spec: authorizationOptions: openShiftSSO: accessReview: group: <API group of resource> name: <Name of resource being requested or deleted> namespace: <Namespace of action being requested> resource: <An existing resource type> subresource: <An existig resource type> verb: <A Kubernetes resource API verb> version: <API version of resource>