-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #82 from stakater/main-update
Update main with 10.0 docs
- Loading branch information
Showing
45 changed files
with
498 additions
and
132 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| # Authentication and Authorization in MTO Console | ||
|
|
||
| ## Keycloak for Authentication | ||
|
|
||
| MTO Console incorporates Keycloak, a leading authentication module, to manage user access securely and efficiently. Keycloak is provisioned automatically by our controllers, setting up a new realm, client, and a default user named `mto`. | ||
|
|
||
| ### Benefits | ||
|
|
||
| - Industry Standard: Offers robust, reliable authentication in line with industry standards. | ||
| - Integration with Existing Systems: Enables easy linkage with existing Active Directories or SSO systems, avoiding the need for redundant user management. | ||
| - Administrative Control: Grants administrators full authority over user access to the console, enhancing security and operational integrity. | ||
|
|
||
| ## PostgreSQL as Persistent Storage for Keycloak | ||
|
|
||
| MTO Console leverages PostgreSQL as the persistent storage solution for Keycloak, enhancing the reliability and flexibility of the authentication system. | ||
|
|
||
| It offers benefits such as enhanced data reliability, easy data export and import. | ||
|
|
||
| ### Benefits | ||
|
|
||
| - Persistent Data Storage: By using PostgreSQL, Keycloak's data, including realms, clients, and user information, is preserved even in the event of a pod restart. This ensures continuous availability and stability of the authentication system. | ||
| - Data Exportability: Customers can easily export Keycloak configurations and data from the PostgreSQL database. | ||
| - Transferability Across Environments: The exported data can be conveniently imported into another cluster or Keycloak instance, facilitating smooth transitions and backups. | ||
| - No Data Loss: Ensures that critical authentication data is not lost during system updates or maintenance. | ||
| - Operational Flexibility: Provides customers with greater control over their authentication data, enabling them to manage and migrate their configurations as needed. | ||
|
|
||
| ## Built-in module for Authorization | ||
|
|
||
| The MTO Console is equipped with an authorization module, designed to manage access rights intelligently and securely. | ||
|
|
||
| ### Benefits | ||
|
|
||
| - User and Tenant Based: Authorization decisions are made based on the user's membership in specific tenants, ensuring appropriate access control. | ||
| - Role-Specific Access: The module considers the roles assigned to users, granting permissions accordingly to maintain operational integrity. | ||
| - Elevated Privileges for Admins: Users identified as administrators or members of the clusterAdminGroups are granted comprehensive permissions across the console. | ||
| - Database Caching: Authorization decisions are cached in the database, reducing reliance on the Kubernetes API server. | ||
| - Faster, Reliable Access: This caching mechanism ensures quicker and more reliable access for users, enhancing the overall responsiveness of the MTO Console. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| # MTO Console | ||
|
|
||
| ## Introduction | ||
|
|
||
| The Multi Tenant Operator (MTO) Console is a comprehensive user interface designed for both administrators and tenant users to manage multi-tenant environments. The MTO Console simplifies the complexity involved in handling various aspects of tenants and their related resources. | ||
|
|
||
| ## Dashboard Overview | ||
|
|
||
| The dashboard serves as a centralized monitoring hub, offering insights into the current state of tenants, namespaces, and quotas. It is designed to provide a quick summary/snapshot of MTO resources' status. Additionally, it includes a Showback graph that presents a quick glance of the seven-day cost trends associated with the namespaces/tenants based on the logged-in user. | ||
|
|
||
|  | ||
|
|
||
| ### Tenants | ||
|
|
||
| Here, admins have a bird's-eye view of all tenants, with the ability to delve into each one for detailed examination and management. This section is pivotal for observing the distribution and organization of tenants within the system. More information on each tenant can be accessed by clicking the view option against each tenant name. | ||
|
|
||
|  | ||
|
|
||
| ### Namespaces | ||
|
|
||
| Users can view all the namespaces that belong to their tenant, offering a comprehensive perspective of the accessible namespaces for tenant members. This section also provides options for detailed exploration. | ||
|
|
||
|  | ||
|
|
||
| ### Quotas | ||
|
|
||
| MTO's Quotas are crucial for managing resource allocation. In this section, administrators can assess the quotas assigned to each tenant, ensuring a balanced distribution of resources in line with operational requirements. | ||
|
|
||
|  | ||
|
|
||
| ### Templates | ||
|
|
||
| The Templates section acts as a repository for standardized resource deployment patterns, which can be utilized to maintain consistency and reliability across tenant environments. Few examples include provisioning specific k8s manifests, helm charts, secrets or configmaps across a set of namespaces. | ||
|
|
||
|  | ||
|  | ||
|
|
||
| ### Showback | ||
|
|
||
| The Showback feature is an essential financial governance tool, providing detailed insights into the cost implications of resource usage by tenant or namespace or other filters. This facilitates a transparent cost management and internal chargeback or showback process, enabling informed decision-making regarding resource consumption and budgeting. | ||
|
|
||
|  | ||
|
|
||
| ## User Roles and Permissions | ||
|
|
||
| ### Administrators | ||
|
|
||
| Administrators have overarching access to the console, including the ability to view all namespaces and tenants. They have exclusive access to the IntegrationConfig, allowing them to view all the settings and integrations. | ||
|
|
||
|  | ||
|
|
||
| ### Tenant Users | ||
|
|
||
| Regular tenant users can monitor and manage their allocated resources. However, they do not have access to the IntegrationConfig and cannot view resources across different tenants, ensuring data privacy and operational integrity. | ||
|
|
||
| ## Live YAML Configuration and Graph View | ||
|
|
||
| In the MTO Console, each resource section is equipped with a "View" button, revealing the live YAML configuration for complete information on the resource. For Tenant resources, a supplementary "Graph" option is available, illustrating the relationships and dependencies of all resources under a Tenant. This dual-view approach empowers users with both the detailed control of YAML and the holistic oversight of the graph view. | ||
|
|
||
| You can find more details on graph visualization here: [Graph Visualization](../reference-guides/graph-visualization.md) | ||
|
|
||
|  | ||
|
|
||
| ## Caching and Database | ||
|
|
||
| MTO integrates a dedicated database to streamline resource management. Now, all resources managed by MTO are efficiently stored in a Postgres database, enhancing the MTO Console's ability to efficiently retrieve all the resources for optimal presentation. | ||
|
|
||
| The implementation of this feature is facilitated by the Bootstrap controller, streamlining the deployment process. This controller creates the PostgreSQL Database, establishes a service for inter-pod communication, and generates a secret to ensure secure connectivity to the database. | ||
|
|
||
| Furthermore, the introduction of a dedicated cache layer ensures that there is no added burden on the kube API server when responding to MTO Console requests. This enhancement not only improves response times but also contributes to a more efficient and responsive resource management system. | ||
|
|
||
| ## Authentication and Authorization | ||
|
|
||
| MTO Console ensures secure access control using a robust combination of Keycloak for authentication and a custom-built authorization module. | ||
|
|
||
| ### Keycloak Integration | ||
|
|
||
| Keycloak, an industry-standard authentication tool, is integrated for secure user login and management. It supports seamless integration with existing ADs or SSO systems and grants administrators complete control over user access. | ||
|
|
||
| ### Custom Authorization Module | ||
|
|
||
| Complementing Keycloak, our custom authorization module intelligently controls access based on user roles and their association with tenants. Special checks are in place for admin users, granting them comprehensive permissions. | ||
|
|
||
| For more details on Keycloak's integration, PostgreSQL as persistent storage, and the intricacies of our authorization module, please visit [here](./auth.md). | ||
|
|
||
| ## Conclusion | ||
|
|
||
| The MTO Console is engineered to simplify complex multi-tenant management. The current iteration focuses on providing comprehensive visibility. Future updates could include direct CUD (Create/Update/Delete) capabilities from the dashboard, enhancing the console’s functionality. The Showback feature remains a standout, offering critical cost tracking and analysis. The delineation of roles between administrators and tenant users ensures a secure and organized operational framework. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,13 +1,48 @@ | ||
| # FAQs | ||
|
|
||
| ## Q. Error received while performing Create, Update or Delete action on namespace `"Cannot CREATE namespace test-john without label stakater.com/tenant"` | ||
| ## Namespace Admission Webhook | ||
|
|
||
| **A.** Error occurs when a user is trying to perform create, update, delete action on a namespace without the required `stakater.com/tenant` label. This label is used by the operator to see that authorized users can perform that action on the namespace. Just add the label with the tenant name so that MTO knows which tenant the namespace belongs to, and who is authorized to perform create/update/delete operations. For more details please refer to [Namespace use-case](./tutorials/tenant/creating-namespaces.md). | ||
| ### Q. Error received while performing Create, Update or Delete action on Namespace | ||
|
|
||
| ## Q. How do I deploy cluster-scoped resource via the ArgoCD integration? | ||
| ```terminal | ||
| Cannot CREATE namespace test-john without label stakater.com/tenant | ||
| ``` | ||
|
|
||
| **A.** Multi-Tenant Operator's ArgoCD Integration allows configuration of which cluster-scoped resources can be deployed, both globally and on a per-tenant basis. For a global allow-list that applies to all tenants, you can add both resource `group` and `kind` to the [IntegrationConfig's](./how-to-guides/integration-config.md#argocd) `spec.argocd.clusterResourceWhitelist` field. Alternatively, you can set this up on a tenant level by configuring the same details within a [Tenant's](./how-to-guides/tenant.md) `spec.argocd.appProject.clusterResourceWhitelist` field. For more details, check out the [ArgoCD integration use cases](./tutorials/argocd/enabling-multi-tenancy-argocd.md#allow-argocd-to-sync-certain-cluster-wide-resources) | ||
| **Answer.** Error occurs when a user is trying to perform create, update, delete action on a namespace without the required `stakater.com/tenant` label. This label is used by the operator to see that authorized users can perform that action on the namespace. Just add the label with the tenant name so that MTO knows which tenant the namespace belongs to, and who is authorized to perform create/update/delete operations. For more details please refer to [Namespace use-case](./tutorials/tenant/creating-namespaces.md). | ||
|
|
||
| ### Q. Error received while performing Create, Update or Delete action on OpenShift Project | ||
|
|
||
| ```terminal | ||
| Cannot CREATE namespace testing without label stakater.com/tenant. User: system:serviceaccount:openshift-apiserver:openshift-apiserver-sa | ||
| ``` | ||
|
|
||
| **Answer.** This error occurs because we don't allow Tenant members to do operations on OpenShift Project, whenever an operation is done on a project, `openshift-apiserver-sa` tries to do the same request onto a namespace. That's why the user sees `openshift-apiserver-sa` Service Account instead of its own user in the error message. | ||
|
|
||
| The fix is to try the same operation on the namespace manifest instead. | ||
|
|
||
| ### Q. Error received while doing "kubectl apply -f namespace.yaml" | ||
|
|
||
| ```terminal | ||
| Error from server (Forbidden): error when retrieving current configuration of: | ||
| Resource: "/v1, Resource=namespaces", GroupVersionKind: "/v1, Kind=Namespace" | ||
| Name: "ns1", Namespace: "" | ||
| from server for: "namespace.yaml": namespaces "ns1" is forbidden: User "muneeb" cannot get resource "namespaces" in API group "" in the namespace "ns1" | ||
| ``` | ||
|
|
||
| **Answer.** Tenant members will not be able to use `kubectl apply` because `apply` first gets all the instances of that resource, in this case namespaces, and then does the required operation on the selected resource. To maintain tenancy, tenant members do not the access to get or list all the namespaces. | ||
|
|
||
| The fix is to create namespaces with `kubectl create` instead. | ||
|
|
||
| ## MTO - ArgoCD Integration | ||
|
|
||
| ### Q. How do I deploy cluster-scoped resource via the ArgoCD integration? | ||
|
|
||
| **Answer.** Multi-Tenant Operator's ArgoCD Integration allows configuration of which cluster-scoped resources can be deployed, both globally and on a per-tenant basis. For a global allow-list that applies to all tenants, you can add both resource `group` and `kind` to the [IntegrationConfig's](./how-to-guides/integration-config.md#argocd) `spec.argocd.clusterResourceWhitelist` field. Alternatively, you can set this up on a tenant level by configuring the same details within a [Tenant's](./how-to-guides/tenant.md) `spec.argocd.appProject.clusterResourceWhitelist` field. For more details, check out the [ArgoCD integration use cases](./tutorials/argocd/enabling-multi-tenancy-argocd.md#allow-argocd-to-sync-certain-cluster-wide-resources) | ||
|
|
||
| ## Q. InvalidSpecError: application repo \<repo\> is not permitted in project \<project\> | ||
|
|
||
| **A.** The above error can occur if the ArgoCD Application is syncing from a source that is not allowed the referenced AppProject. To solve this, verify that you have referred to the correct project in the given ArgoCD Application, and that the repoURL used for the Application's source is valid. If the error still appears, you can add the URL to the relevant Tenant's `spec.argocd.sourceRepos` array. | ||
| **Answer.** The above error can occur if the ArgoCD Application is syncing from a source that is not allowed the referenced AppProject. To solve this, verify that you have referred to the correct project in the given ArgoCD Application, and that the repoURL used for the Application's source is valid. If the error still appears, you can add the URL to the relevant Tenant's `spec.argocd.sourceRepos` array. | ||
|
|
||
| ## Q. Why are there `mto-showback-*` pods failing in my cluster? | ||
|
|
||
| **Answer.** The `mto-showback-*` pods are used to calculate the cost of the resources used by each tenant. These pods are created by the Multi-Tenant Operator and are scheduled to run every 10 minutes. If the pods are failing, it is likely that the operator's necessary to calculate cost are not present in the cluster. To solve this, you can navigate to `Operators` -> `Installed Operators` in the OpenShift console and check if the MTO-OpenCost and MTO-Prometheus operators are installed. If they are in a pending state, you can manually approve them to install them in the cluster. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.