Chapter 12. Manage identities and authorizations

Procedure

1. Define the user roles name:

   $ USER_ROLES=<name>

   where:

   name

   Unique resource name.

2. Determine the namespace where the OpenShift Dev Spaces Operator is deployed:

   $ OPERATOR_NAMESPACE=$(oc get pods -l app.kubernetes.io/component=devspaces-operator -o jsonpath={".items[0].metadata.namespace"} --all-namespaces)

3. Create needed roles:

   $ oc apply -f - <<EOF
   kind: ClusterRole
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: ${USER_ROLES}
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
   rules:
     - verbs:
         - <verbs>
       apiGroups:
         - <apiGroups>
       resources:
         - <resources>
   EOF

   where:

   verbs

   List all Verbs that apply to all ResourceKinds and AttributeRestrictions contained in this rule. You can use * to represent all verbs.

   apiGroups

   Name the APIGroups that contain the resources.

   resources

   List all resources that this rule applies to. You can use * to represent all verbs.

4. Delegate the roles to the OpenShift Dev Spaces Operator:

   $ oc apply -f - <<EOF
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: ${USER_ROLES}
     labels:
       app.kubernetes.io/part-of: che.eclipse.org
   subjects:
     - kind: ServiceAccount
       name: devspaces-operator
       namespace: ${OPERATOR_NAMESPACE}
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: ${USER_ROLES}
   EOF

5. Configure the OpenShift Dev Spaces Operator to delegate the roles to the che service account:

   $ oc patch checluster devspaces \
     --patch '{"spec": {"components": {"cheServer": {"clusterRoles": ["'${USER_ROLES}'"]}}}}' \
     --type=merge -n {prod-namespace}

6. Configure the OpenShift Dev Spaces server to delegate the roles to a user:

   $ oc patch checluster devspaces \
     --patch '{"spec": {"devEnvironments": {"user": {"clusterRoles": ["'${USER_ROLES}'"]}}}}' \
     --type=merge -n {prod-namespace}

7. Wait for the rollout of the OpenShift Dev Spaces server components to complete.
8. Ask the user to log out and log in to have the new roles applied.

Procedure

1. Configure the CheCluster Custom Resource. See Section 2.2, “Use the CLI to configure the CheCluster Custom Resource”.

   spec:
     networking:
       auth:
         advancedAuthorization:
           allowUsers:
             - <allow_users>
           allowGroups:
             - <allow_groups>
           denyUsers:
             - <deny_users>
           denyGroups:
             - <deny_groups>

   where:

   allowUsers

   List of users allowed to access Red Hat OpenShift Dev Spaces.

   allowGroups

   List of groups of users allowed to access Red Hat OpenShift Dev Spaces (for OpenShift Container Platform only).

   denyUsers

   List of users denied access to Red Hat OpenShift Dev Spaces.

   denyGroups

   List of groups of users denied access to Red Hat OpenShift Dev Spaces (for OpenShift Container Platform only).

   If a user is on both allow and deny lists, access is denied. If allowUsers and allowGroups are empty, all users are allowed except the ones on the deny lists. If denyUsers and denyGroups are empty, only the users from allow lists are allowed. If both allow and deny lists are empty, all users are allowed.

2. Wait for the rollout of the OpenShift Dev Spaces server components to complete.

Procedure

1. List all the users in the OpenShift cluster using the following command:

   $ oc get users

2. Delete the user entry:

   Important

   If the user has any associated resources (such as projects, roles, or service accounts), you must delete those first before deleting the user.

   $ oc delete user <username>