Define abac setup for the cluster

[v47]

https://kubernetes.io/docs/reference/access-authn-authz/abac/

[tegail]

Main questions: what roles do you have by default?

• EmergencyAccess
• Database Engineers
• DevOps Engineers
• Security Engineers
• Network Engineers
• DeveloperAdmin
• DeveloperUser
• Technical Account Manager
• Incident Response Engineer
• Observer

what is the difference between role access level?

• EmergencyAccess is highly privileged Admin access, no restrictions on actions.
• DeveloperAdmin is highly privileged but is not SCP exempt for anything
• DeverloperUser, Database, DevOps, Security, Network, TAM and Incident Response (EOC) are all job role specific, matching least privilege to their ability to perform standard job functions. Effective permissions vary role to role but overall match the task. Example: DevOps has SystemAdministrator like permissions, Database has Database Admin permissions, etc. All roles are subject to SCPs, unless specifically exempted.
• Observer is strictly read-only, this serves as the landing for all user access. Unless there is a job need to promote to one of the higher levels of permissions everyone should start with this role.

do you have roles that can ignore SCPs?

• Yes, in general we use SCPs to enforce actions through code deployments and ensure change management is followed. There are some exceptions allowed, such as Administrator Role can bypass most all SCPs but this is limited to a handful of members. EmergencyAccess can bypass all SCPs. Network Engineer can bypass the Networking service SCPs. Security Engineers can bypass the security service SCPs.