search

cloud-ark / kubeplus

Kubernetes Operator for multi-instance multi-tenancy
https://cloudark.io/
Apache License 2.0
654 stars 78 forks source link

Generate separate consumer kubeconfig per user/team #1276

Open devdattakulkarni opened 4 months ago

devdattakulkarni commented 4 months ago

KubePlus generates a consumer kubeconfig which can be used by users to create application instances in a self-service manner. Currently, only one consumer kubeconfig is generated by KubePlus. We should support the creation of separate kubeconfig files for different user/teams. Each team should be able to access only their application instance and no one else's.

One way to achieve this will be to tie the consumer kubeconfig to the Namespace.

We can add a kubectl plugin to generate consumer kubeconfig kubectl generate consumer kubeconfig <Namespace>

As part of generating the kubeconfig, we should grant the new SA permissions on *.platformapi.kubeplus APIs.

But when we do this, we have to ensure that the application deployments happen in that namespace. Currently KubePlus will create a new Namespace for deploying an application. We will have to change that model to be able to support deployments in existing namespaces.

devdattakulkarni commented 1 month ago

@chiukapoor In our discussion today, I was referring to this issue.