Project based isolation
What Will You Do¶
In this part of the self-paced exercise, we will focus on the following use case:
Teams have dedicated clusters assigned to them. Platform teams want to manage these clusters centrally and ensure that teams only have access to their respective clusters.
For this example, we will consider two teams, alpha and beta each having their dedicated clusters, alpha-cluster and beta-cluster respectively.
Declarative specifications are also provided for this exercise.
Step 1: Create projects for alpha and beta teams¶
- Login into your Org as an Org Admin
- Click on New Project
- Provide the name for the project (e.g. alpha) and a suitable description
- Click Create
- Repeat the same exercise and create another project for team beta
Step 2: Create cluster entries, download bootstrap¶
- Navigate to project alpha
- Click on New Cluster
- Select Import Existing Kubernetes Cluster
- Click Continue
- Select Environment and Kubernetes Distribution as appropriate
- Provide a cluster name (e.g. alpha-cluster) and description as needed
- Click Continue
- For this example, we will keep the Blueprint selection as minimal, click Continue
- Download the cryptographically unique bootstrap YAML required to register the cluster
Step 3: Apply bootstrap to initiate the import process¶
Use kubectl to apply the "cluster bootstrap" file on your K8s cluster.
kubectl apply -f [path to file]/alpha-cluster-bootstrap.yaml
This will create a namespace for the k8s mgmt operator, download the container images, and register with the controller. This one time import process can take ~2 minutes.
namespace/rafay-system created
serviceaccount/system-sa created
clusterrole.rbac.authorization.k8s.io/rafay:manager created
clusterrolebinding.rbac.authorization.k8s.io/rafay:rafay-system:manager-rolebinding created
clusterrole.rbac.authorization.k8s.io/rafay:proxy-role created
clusterrolebinding.rbac.authorization.k8s.io/rafay:rafay-system:proxy-rolebinding created
priorityclass.scheduling.k8s.io/rafay-cluster-critical created
role.rbac.authorization.k8s.io/rafay:leader-election-role created
rolebinding.rbac.authorization.k8s.io/rafay:leader-election-rolebinding created
customresourcedefinition.apiextensions.k8s.io/namespaces.cluster.rafay.dev created
customresourcedefinition.apiextensions.k8s.io/tasklets.cluster.rafay.dev created
customresourcedefinition.apiextensions.k8s.io/tasks.cluster.rafay.dev created
service/controller-manager-metrics-service-v3 created
deployment.apps/controller-manager-v3 created
configmap/connector-config-v3 created
configmap/proxy-config-v3 created
deployment.apps/rafay-connector-v3 created
service/rafay-drift-v3 created
validatingwebhookconfiguration.admissionregistration.k8s.io/rafay-drift-validate-v3 created
Repeat Steps (3) and (4) with Project "beta" and cluster "beta-cluster".
Step 4: Verify that the clusters are imported to the right projects¶
On the console, you will notice that the imported cluster would have registered itself and will start receiving instructions from the controller. You can also check the status of the mgmt operator pods on your cluster using kubectl.
kubectl get po -n rafay-system
You should something like
NAME READY STATUS RESTARTS AGE
controller-manager-v3-66dfbd5db4-v97vw 1/1 Running 0 68s
edge-client-84499dfdd4-qn67q 1/1 Running 0 71s
rafay-connector-v3-7fb99b5cd9-clh2g 1/1 Running 0 68s
relay-agent-556c86f7bc-chxk8 1/1 Running 0 2m49s
Once the k8s operator is operational, it will "establish and maintain a heartbeat" with the controller.
Step 5: Create "project specific roles" for users¶
- Navigate to System -> Users
- Click on New User
- Input appropriate details (do not add any groups as yet)
- Click Save & Exit
- You will see a pop-up stating that the user has not been assigned to any groups. Select Yes to continue
- Select the user that was just created
- Click on the Projects tab
- Select Assign User To Project
- Select alpha project from the dropdown on the left
- Select the Project Admin role or Infra Admin role
-
Click Save & Exit
-
Log out of the console now and log in as the user that was created
- You can now notice that the user only has access to alpha project and cannot view project beta (and the resources in project beta)
Recap¶
Congratulations! At this point, you have successfully leveraged "Projects" to achieve isolation between clusters belonging to two different teams.
Step 1: Create projects for alpha and beta teams¶
You can alternatively create projects by using the declarative spec. For more information on automation via RCTL CLI, refer here.
apiVersion: system.k8smgmt.io/v3
kind: Project
metadata:
description: self-contained unit for team alpha
name: alpha
spec:
default: false
- Type the command below to create project alpha
rctl apply -f <path-to-filename>.yaml
- Repeat the same exercise and create another project for team beta
Step 2: Create cluster entries, download bootstrap¶
An illustrative example of the cluster spec YAML file is shown below.
kind: Cluster
metadata:
name: alpha-cluster
project: alpha
spec:
type: imported
# location, can be custom or predefined
location: newyorkcity-us
blueprint: minimal
- Type the command below to create a cluster entry in project alpha
rctl create cluster -f <path-to-filename>.yaml
- Type the command below to download the cryptographically unique bootstrap YAML required to register the cluster
rctl get clusterbootstrap alpha-cluster -o yaml > <path-to-bootstrap-filename>.yaml
Step 3: Apply bootstrap to initiate the import process¶
Use kubectl to apply the "cluster bootstrap" file on your K8s cluster.
kubectl apply -f [path to file]/alpha-cluster-bootstrap.yaml
This will create a namespace for the k8s mgmt operator, download the container images, and register with the controller. This one time import process can take ~2 minutes.
namespace/rafay-system created
serviceaccount/system-sa created
clusterrole.rbac.authorization.k8s.io/rafay:manager created
clusterrolebinding.rbac.authorization.k8s.io/rafay:rafay-system:manager-rolebinding created
clusterrole.rbac.authorization.k8s.io/rafay:proxy-role created
clusterrolebinding.rbac.authorization.k8s.io/rafay:rafay-system:proxy-rolebinding created
priorityclass.scheduling.k8s.io/rafay-cluster-critical created
role.rbac.authorization.k8s.io/rafay:leader-election-role created
rolebinding.rbac.authorization.k8s.io/rafay:leader-election-rolebinding created
customresourcedefinition.apiextensions.k8s.io/namespaces.cluster.rafay.dev created
customresourcedefinition.apiextensions.k8s.io/tasklets.cluster.rafay.dev created
customresourcedefinition.apiextensions.k8s.io/tasks.cluster.rafay.dev created
service/controller-manager-metrics-service-v3 created
deployment.apps/controller-manager-v3 created
configmap/connector-config-v3 created
configmap/proxy-config-v3 created
deployment.apps/rafay-connector-v3 created
service/rafay-drift-v3 created
validatingwebhookconfiguration.admissionregistration.k8s.io/rafay-drift-validate-v3 created
Repeat Steps (3) and (4) with Project "beta" and cluster "beta-cluster".
Step 4: Verify that the clusters are imported to the right projects¶
On the console, you will notice that the imported cluster would have registered itself and will start receiving instructions from the controller. You can also check the status of the mgmt operator pods on your cluster using kubectl.
kubectl get po -n rafay-system
You should something like
NAME READY STATUS RESTARTS AGE
controller-manager-v3-66dfbd5db4-v97vw 1/1 Running 0 68s
edge-client-84499dfdd4-qn67q 1/1 Running 0 71s
rafay-connector-v3-7fb99b5cd9-clh2g 1/1 Running 0 68s
relay-agent-556c86f7bc-chxk8 1/1 Running 0 2m49s
Once the k8s operator is operational, it will "establish and maintain a heartbeat" with the controller.
Step 5: Create "project specific roles" for users¶
- Navigate to System -> Users
- Click on New User
- Input appropriate details (do not add any groups as yet)
- Click Save & Exit
- You will see a pop-up stating that the user has not been assigned to any groups. Select Yes to continue
- Select the user that was just created
- Click on the Projects tab
- Select Assign User To Project
- Select alpha project from the dropdown on the left
- Select the Project Admin role or Infra Admin role
-
Click Save & Exit
-
Log out of the console now and log in as the user that was created
- You can now notice that the user only has access to alpha project and cannot view project beta (and the resources in project beta)
Recap¶
Congratulations! At this point, you have successfully leveraged "Projects" to achieve isolation between clusters belonging to two different teams.