What roles should be created/used for deploying a service that uses istio?

0
votes

I'm building out an istio enabled RBAC AKS cluster. I have the cluster-admin role assigned to me, and I'm able to successfully deploy a minimal istio service (Service/Deployment/Gateway/VirtualService) with no problems.

I need to give a team within my org access to AKS, so I created a namespace and assigned them admin role on the namespace. Everything that is k8s native (kubectl get services --namespace team) works great. However, when they went to deploy the same minimal istio service (Service/Deployment/Gateway/VirtualService) they got a host of errors similar to: 

Error from server (Forbidden): error when retrieving current configuration of:
Resource: "networking.istio.io/v1alpha3, Resource=gateways", GroupVersionKind: "networking.istio.io/v1alpha3, Kind=Gateway"

This makes sense, as I didn't bind the group to any istio roles. Once I granted them cluster-admin, it worked as expected.

The problem is, I don't know which istio roles to add. When I look at the roles that exist in the cluster after istio installation, I don't see any obvious role(s).

Roles I see:

  • istio-citadel-istio-system
  • istio-vnetingressgateway-istio-system
  • istio-sidecar-injector-istio-system
  • istio-security-post-install-istio-system
  • istio-pilot-istio-system
  • istio-ingressgateway-istio-system
  • istio-grafana-post-install-istio-system
  • istio-mixer-istio-system
  • istio-galley-istio-system
  • istio-egressgateway-istio-system

What is the appropriate role(s) for users that that need to operate on an istio deployment (within a namespace)? Is it a combination of roles? Do I need a new role?

2
azurekubernetesistioazure-aks
I think it's not the limitation of Istio. It should be the limitation of the AKS. As you say, you grant them cluster-admin, not the Istio role, then it works. All the roles you show named istos-*, they are the Istio roles, not the AKS cluster. - Charles Xu

2 Answers

2
votes

Role with something like this should work:

"apiGroups": [
    "istio.io"
],
"resources": [
    "*"
],
"verbs": [
    "*"
]

if that doesnt work you'd need to do something like this:

"apiGroups": [
    "config.istio.io",
    "networking.istio.io",
    "rbac.istio.io",
    "authentication.istio.io"
],
"resources": [
    "*"
],
"verbs": [
    "*"
]

You could create a Role or Clusterrole and bindings or role bindings for your users.

2
votes

I used the following, which aggregates to the default edit (and in turn admin) ClusterRoles. Then any account bound to edit or admin can modify Istio resources:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: istio-edit
rules:
- apiGroups:
  - "config.istio.io"
  - "networking.istio.io"
  - "rbac.istio.io"
  - "authentication.istio.io"
  - "security.istio.io"
  resources:
  - "*"
  verbs:
  - "*"