Chapter 3. RBAC mapping configuration

Procedure

1. Define a custom permission mapping in a ConfigMap object.

   Example of a ConfigMap containing the permission mapping

   apiVersion: v1
   kind: ConfigMap
   metadata:
     name: auth-properties
   data:
     auth.properties: |
       TARGET=pods,deployments.apps
       RECORDING=pods,pods/exec
       CERTIFICATE=deployments.apps,pods,cryostats.operator.cryostat.io
       CREDENTIALS=cryostats.operator.cryostat.io

   To use custom permission mapping, a ClusterRole must exist and contain permissions for all Red Hat OpenShift objects listed in custom permission mapping.

   Example of a ClusterRole that contains the necessary rules

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: additional-oauth-client
   rules:
   - apiGroups:
     - operator.cryostat.io
     resources:
     - cryostats
     verbs:
     - create
     - patch
     - delete
     - get
   - apiGroups:
     - ""
     resources:
     - pods
     - pods/exec
     verbs:
     - create
     - patch
     - delete
     - get
   - apiGroups:
     - apps
     resources:
     - deployments
     verbs:
     - create
     - patch
     - delete
     - get

   After you enter your credentials on the Red Hat OpenShift web console, the OAuth server uses your credentials and the specified scope to generate an API token.

2. Provide the authProperties spec in the Cryostat Custom Resource (CR) to reference the ConfigMap that holds the mapping content, and ClusterRole that defines RBAC access for those mapped Red Hat OpenShift resources.

   Example of a Cryostat CR with authProperties that define a custom permission mapping

   apiVersion: operator.cryostat.io/v1beta1
   kind: Cryostat
   metadata:
     name: cryostat-sample
   spec:
     authProperties:
   	configMapName: auth-properties
   	filename: auth.properties
   	clusterRoleName: oauth-cluster-role

   Alternatively, you can open your Red Hat OpenShift web console, create a Cryostat instance, and define ClusterRole Name, ConfigMap Name, and Filename properties in the Authorization Properties option, which you can access in the Advanced configuration section.

   Figure 3.1. The Advanced configuration section on the OpenShift web console

   

Verification

1. From the Installed Operators menu, select your Cryostat instance.
2. Click the link in the Application URL section to access the login screen. The OAuth server redirects you to an OpenShift Container Platform login page.
3. Enter your credential details and then click Login. For the first time you log in through the OAuth server, an Authorize Access page opens on your web browser.
4. From the Requested Permissions option, confirm that the cluster role name matches the name that you specified in the Cryostat CR.

5. From the Authorize Access window, you can select the required checkboxes. For optimal Cryostat performance, select all checkboxes.

   Figure 3.2. The Authorize Access window that lists three permissions

   

   The Authorize Access window lists the following permissions:

   • User:check-access, which is a permission check that the internal Cryostat application requests. Permission provides a user with read-only access to view their privileges.
   • role:cryostat-operator-oauth-client:<namespace>, which is a permission check that the internal Cryostat application requests. Replace <namespace> with the name of your project name or your namespace from your CLI. Permission provides a user with access to complete any operations that the cryostat-operator-oauth-client role specifies, except access to escalate resources, such as secrets.
   • role:<user-define-clusterrole-name>:<namespace>: The clusterrole that you defined in the Cryostat CR spec. Replace <namespace> with the name of your project name or your namespace from your CLI. Permission provides a user with access to complete any operations that the additional-oauth-client role specifies, except escalating access to resources, such as secrets.

6. Choose one of the following options:

   1. Click Allow selected permissions if you want to accept the selected requested permissions.

   2. Click Deny button if you want to reject all requested permission options.

      Your web browser redirects you to the Cryostat web console, where you can monitor Java applications that are running in a Java Virtual Machine (JVM).