Access Policies (ACLs)

This page describes the fields of the AccessPolicy resource. For how Omni evaluates access policies, complete examples, and the Kubernetes RBAC setup that access policies depend on, see Manage Access Policies (ACLs).

ACLs grant access but do not revoke it. Kubernetes groups other than system:masters have no permissions until they are bound to a Role or ClusterRole through Kubernetes RBAC.

`AccessPolicy`

The AccessPolicy is a single resource containing a set of user groups, a set of cluster groups, a list of matching rules, and a list of tests.

metadata:
  namespace: default
  type: AccessPolicies.omni.sidero.dev
  id: access-policy
spec:
  usergroups: {}
  clustergroups: {}
  rules: []
  tests: []

Field	Type	Description
`metadata.namespace`	string	Always set to `default`.
`metadata.type`	string	`AccessPolicies.omni.sidero.dev`.
`metadata.id`	string	Always set to `access-policy`.
`spec.usergroups`	map[string]UserGroup	Map of user group names to user group definitions.
`spec.clustergroups`	map[string]ClusterGroup	Map of cluster group names to cluster group definitions.
`spec.rules`	array	List of rules to match.
`spec.tests`	array	List of tests to run when the resource is created or updated.

`UserGroup`

A UserGroup is a group of users.

users:
  - name: user1@example.com
  - name: user2@example.com

Field	Type	Description
`users`	array	List of Users.

`User`

A User is a single user.

name: user1@example.com
match: user1*
labelselectors:
  - level=1

Field	Type	Description
`name`	string	User identity used to authenticate to Omni.
`match`	string	Glob pattern to match user identities.
`labelselectors`	array	List of label selectors matched against the user’s identity labels. All selectors must match.

name, match, and labelselectors are mutually exclusive. Set only one of them for each user.Common label selector forms are key=value (the label has this value), key (the label exists), and !key (the label does not exist). Other operators, such as !=, in, and notin, are also supported.

`ClusterGroup`

A ClusterGroup is a group of clusters.

clusters:
  - name: cluster-1
  - name: cluster-2

Field	Type	Description
`clusters`	array	List of Clusters.

`Cluster`

A Cluster is a single cluster.

name: cluster-1
match: cluster-1*

Field	Type	Description
`name`	string	Cluster name (ID).
`match`	string	Glob pattern to match cluster names (IDs).

name and match are mutually exclusive. Set only one of them for each cluster.

match: "*" matches all clusters. A rule whose cluster group uses match: "*" also applies its role to lists of resources across all clusters. Other patterns, such as prod-*, do not, even when they match every cluster.

`Rule`

A Rule is a set of users, clusters, an Omni role, and Kubernetes impersonation groups. The reserved prefix group/ references a user group in users or a cluster group in clusters. Entries without the prefix must match a user identity or cluster name exactly.

users:
  - user1@example.com
  - group/user-group-1
clusters:
  - cluster1
  - group/cluster-group-1
role: Operator
kubernetes:
  impersonate:
    groups:
      - another-impersonation-group

Field	Type	Description
`users`	array	User identities, or `group/` references to UserGroups.
`clusters`	array	Cluster names, or `group/` references to ClusterGroups.
`role`	enum	Role to grant to the user on the matching clusters. Optional.
`kubernetes.impersonate.groups`	array	Kubernetes groups to assign to the user on the matching clusters.

`Role`

A Role is the Omni role to grant to the user on the matching clusters. Possible values: None, Reader, Operator, Admin. The Auditor role cannot be assigned by an ACL, because audit log access is account-wide rather than cluster-scoped. A rule that grants Operator or Admin also assigns the Kubernetes group system:masters. A rule without a role grants no role, but still assigns its Kubernetes groups. The user’s effective role on a cluster is the higher of their Omni role and the role granted by the ACL. Downloading a kubeconfig requires at least Reader on the cluster.

`Test`

A Test is a single test case. Omni runs the tests when the resource is created or updated, and rejects the change if any test fails.

name: support engineer has full access to staging cluster
user:
  name: support1@example.com
cluster:
  name: staging-cluster-1
expected:
  role: Operator

Field	Type	Description
`name`	string	Name of the test case. Required.
`user`	TestUser	User identity to use in the test.
`cluster`	TestCluster	Cluster to use in the test.
`expected`	Expected	Expected result.

`TestUser`

A TestUser is the user identity to use in a test case.

name: user1@example.com
labels:
  level: "1"

Field	Type	Description
`name`	string	User identity to use in the test. Required.
`labels`	map[string]string	Map of label names to label values.

`TestCluster`

A TestCluster is the cluster to use in a test case.

name: cluster-1

Field	Type	Description
`name`	string	Cluster name (ID). Required.

`Expected`

An Expected is the expected result of a test case.

role: Operator
kubernetes:
  impersonate:
    groups:
      - another-impersonation-group

Field	Type	Description
`role`	enum	Expected Role. If omitted, the test does not check the role.
`kubernetes.impersonate.groups`	array	Expected Kubernetes impersonation groups. The test compares only the groups listed in the matching rules, and omitting this field expects no groups.

Overview

Getting Started

Self Hosted

Infrastructure and Extensions

Omni Cluster Setup

Cluster Management

Security and Authentication

Reference

Troubleshooting and Support

`AccessPolicy`

`UserGroup`

`User`

`ClusterGroup`

`Cluster`

`Rule`

`Role`

`Test`

`TestUser`

`TestCluster`

`Expected`

​AccessPolicy

​UserGroup

​User

​ClusterGroup

​Cluster

​Rule

​Role

​Test

​TestUser

​TestCluster

​Expected

`AccessPolicy`

`UserGroup`

`User`

`ClusterGroup`

`Cluster`

`Rule`

`Role`

`Test`

`TestUser`

`TestCluster`

`Expected`