-
Notifications
You must be signed in to change notification settings - Fork 11
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
4fa859b
commit cb340dd
Showing
4 changed files
with
89 additions
and
6 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -60,6 +60,77 @@ In this instance the images in the _`plrl-console`_ namespace | |
were taking a bit longer to download and initialize. | ||
Once the services were _up_ in the cli, I was able to access the console url | ||
|
||
### Cannot list resources in the Kubernetes Dashboard | ||
### "Cannot list resources in the Kubernetes Dashboard" | ||
![alt text](/images/how-to/k8s-dash-403.png) | ||
This is expected and due to missing [RBAC Bindings](https://github.com/pluralsh/documentation/blob/main/pages/deployments/dashboard.md) for the console users | ||
|
||
##### Creating an RBAC Service | ||
* **Create an `rbac` dir in your MGMT repo | ||
and add the desired [k8s yaml](https://github.com/pluralsh/documentation/blob/main/pages/deployments/dashboard.md)** | ||
```yaml | ||
apiVersion: rbac.authorization.k8s.io/v1 | ||
kind: ClusterRoleBinding | ||
metadata: | ||
name: someones-binding | ||
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: ClusterRole | ||
name: cluster-admin | ||
subjects: | ||
- apiGroup: rbac.authorization.k8s.io | ||
kind: User | ||
name: [email protected] | ||
# This will create a single binding for the [email protected] user to the cluster-admin k8s role | ||
``` | ||
|
||
* **Create a `services` dir in your MGMT repo** | ||
* Add a Service Deployment CRD | ||
This will create a service to sync the rbac bindings | ||
```yaml | ||
apiVersion: deployments.plural.sh/v1alpha1 | ||
kind: ServiceDeployment | ||
metadata: | ||
name: rbac | ||
spec: | ||
clusterRef: | ||
kind: Cluster | ||
name: mgmt | ||
namespace: infra | ||
namespace: plrl-rbac | ||
git: | ||
folder: rbac | ||
ref: main | ||
repositoryRef: | ||
kind: GitRepository | ||
name: infra # can point to any git repository CRD | ||
namespace: infra | ||
``` | ||
* **Commit and push your changes** | ||
* **Apply the Service CRD to the MGMT Cluster** | ||
`kubectl apply -f ./services/rbac.yaml` | ||
|
||
#### (Optionally) Make the RBAC Service Global | ||
###### ℹ️ If you created a service with the Console UI | ||
###### you need to manually apply the service CRD referenced by the Global Service | ||
* **Navigate to `https://console.[your-sub-domain].onplural.sh/cd/globalservices`** | ||
|
||
* **Click the `New Global Service` button** | ||
* Service Name: Name of the Existing Service | ||
* (Optionally) Add Cluster Tags | ||
* Select the Cloud Provider Distributions to Propagate the changes | ||
* **Click `Continue`** | ||
* **Copy and Modify the Generated YAML** | ||
```yaml | ||
apiVersion: deployments.plural.sh/v1alpha1 | ||
kind: GlobalService | ||
metadata: | ||
name: global-rbac | ||
namespace: infra | ||
spec: | ||
serviceRef: | ||
name: rbac # ⬅️ We need to update this with the service we created for rbac | ||
namespace: infra | ||
``` | ||
* **(Optionally) Save the Global Service YAML** | ||
* Saving the global service yaml is not required once it is applied to the cluster | ||
* I keep the applied yaml in `services/global-rbac.yaml` for reference |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters