Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mention Kubernetes Access Control #118

Merged
merged 2 commits into from
Sep 11, 2024
Merged

Mention Kubernetes Access Control #118

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe72102
`Docs`: Mention Kubernetes access control
Jan-Schuppik Aug 30, 2024
4c533f1
`Docs`: Move access control to installation and refine wording
lippserd Sep 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions doc/02-Installation.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,37 @@ You can also use our [Helm charts](https://github.com/Icinga/helm-charts/tree/ma
provide a ready-to-use Icinga stack.
<!-- {% endif %} -->

## Kubernetes Access Control Requirements

Icinga for Kubernetes requires the following read-only permissions on all resources within a Kubernetes cluster:

* **get**: Allows to retrieve details of resources.
* **list**: Allows to list all instances of resources.
* **watch**: Allows to watch for changes to resources.

You can grant these permissions by creating a `ClusterRole` with the necessary rules and
binding it to an appropriate service account or user.
Below is an example `ClusterRole` configuration:

```
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: icinga-for-kubernetes
rules:
- apiGroups: [ "*" ]
resources: [ "*" ]
verbs: [ "get", "list", "watch" ]
```

A complete example of the Kubernetes RBAC configuration is included in the
[sample configuration](../icinga-kubernetes.example.yml). As a result,
you don't need to manually configure access when deploying Icinga for Kubernetes using the sample configuration or our
[Helm charts](https://github.com/Icinga/helm-charts/tree/main/charts/icinga-stack).

**When running Icinga for Kubernetes outside of a Kubernetes cluster,
it is required to connect as a user with the necessary permissions.**

## Installing Icinga for Kubernetes Web

With Icinga for Kubernetes and the database fully set up, you have completed the instructions here and can proceed to
Expand Down
Loading