## Problem Statement <!-- What is the problem we hope to validate? Reference how to write a real customer problem statement at https://productcoalition.com/how-to-write-a-good-customer-problem-statement-a815f80189ba for guidance. --> As a Platform Engineer, in order to simplify user management around my infrastructure, I would like to use GitLab as the Single Source of Truth for users accessing attached clusters. - GitLab users should be able to authenticate themself with the cluster - GitLab should provide a mechanism to tie Kubernetes RBAC rules to GitLab users based on roles in GitLab projects and groups Example: - Project Maintainers have namespace-admin rights on the namespace associated with the project - Project Developers have read-only rights on the namespace associated with a project - Project Developers have read-only and deployment rights on the namespace associated with a project - Group Maintainers have namespace-admin rights on the namespaces associated with any project under the group - Group Maintainers have namespace-admin rights on the namespace associated with the group - Group Developers have read-only and deployment rights on the namespace associated with any project under the group As the above examples show, the RBAC rules might need to be customizable so we can support contradicting rules at different companies, like: - Project Developers have read-only rights on the namespace associated with a project - Project Developers have read-only and deployment rights on the namespace associated with a project [Opportunity Canvas](https://docs.google.com/document/d/1ORLgoaREIVNc-N37amhuPdf9zQr_EgipEiRTnuOiZeU/edit#) (internal) ### Solution idea In the agent configuration ``` rbac: groups: *: developer: default-developer-rbac.yaml maintainer: default-maintainer-rbac.yaml gitlab-org/configure: developer: default-developer-rbac.yaml maintainer: default-maintainer-rbac.yaml projects: *: developer: default-developer-rbac.yaml maintainer: default-maintainer-rbac.yaml gitlab-org/gitlab: developer: default-developer-rbac.yaml maintainer: default-maintainer-rbac.yaml ``` ## Reach <!-- Please describe who suffers from this problem. Consider referring to our personas, which are described at https://about.gitlab.com/handbook/marketing/product-marketing/roles-personas/ --> <!-- Please also quantify the problem's reach using the following values, considering an aggregate across GitLab.com and self-managed: 10.0 = Impacts the vast majority (~80% or greater) of our users, prospects, or customers. 6.0 = Impacts a large percentage (~50% to ~80%) of the above. 3.0 = Significant reach (~25% to ~50%). 1.5 = Small reach (~5% to ~25%). 0.5 = Minimal reach (Less than ~5%). --> ## Impact <!-- How do we positively impact the users above and GitLab's business by solving this problem? Please describe briefly, and provide a numerical assessment: 3.0 = Massive impact 2.0 = High impact 1.0 = Medium impact 0.5 = Low impact 0.25 = Minimal impact --> ## Confidence <!-- How do we know this is a problem? Please provide and link to any supporting information (e.g. data, customer verbatims) and use this basis to provide a numerical assessment on our confidence level in this problem's severity: 100% = High confidence 80% = Medium confidence 50% = Low confidence --> ## Effort <!-- How much effort do we think it will be to solve this problem? Please include all counterparts (Product, UX, Engineering, etc) in your assessment and quantify the number of person-months needed to dedicate to the effort. For example, if the solution will take a product manager, designer, and engineer two weeks of effort - you may quantify this as 1.5 (based on 0.5 months x 3 people). --> ### References - https://kubernetes.io/docs/reference/access-authn-authz/authorization/ - https://kubernetes.io/docs/reference/access-authn-authz/authentication/ - https://github.com/sighupio/permission-manager - https://rbac-manager.docs.fairwinds.com/ - Every cloud has a connection to their recommended authentication method. For more info read https://rbac-manager.docs.fairwinds.com/aws/