Kops: Enable rbac as default (for new clusters) / Show warning if not enabled

Created on 16 Dec 2017 · 12Comments · Source: kubernetes/kops

Kops Version: 1.8
Cloud Provider: AWS

Hi community,

Creation of a new Cluster currently does not enable rbac as default. I think we should change that to increase security even if it is uncomfortable.

Rolling Update / Cluster Update / Create Cluster could additionally show a warning if rbac is disabled and link to some guidelines for kops (rbac enable).

Greetings, Thomas

lifecyclrotten

Source

thomaspeitz

👍2

Most helpful comment

@tsupertramp I am fine with a warning message, always feel free to PR away.

chrislovecnm on 1 Mar 2018

👍2

All 12 comments

@justinsb you know eta for upstream?

chrislovecnm on 16 Dec 2017

@liggitt what are your thoughts on this? Do gke and openshift run RBAC by default? I am thinking it is time.

chrislovecnm on 3 Jan 2018

@liggitt what are your thoughts on this? Do gke and openshift run RBAC by default?

Yes, GCE, GKE, kubeadm, openshift, tectonic, etc all enable RBAC by default on new clusters. That requires them to set up permissions for addons or cluster components set up by the installation.

liggitt on 3 Jan 2018

👍1

Reference: https://github.com/kubernetes/kops/pull/4184 - Part to set rbac as default is fulfilled - Makes it sense to enable a warning if the cluster is still running without rbac? - Then i would prepare a PR.

thomaspeitz on 1 Mar 2018

@tsupertramp I am fine with a warning message, always feel free to PR away.

chrislovecnm on 1 Mar 2018

👍2

Need we to point to a migration doc? See https://github.com/kubernetes/kops/issues/2047#issuecomment-369921711

bhack on 2 Mar 2018

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot on 31 May 2018

/remove-lifecycle stale

olemarkus on 31 May 2018

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

fejta-bot on 29 Aug 2018

Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle rotten

fejta-bot on 28 Sep 2018

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

fejta-bot on 28 Oct 2018

@fejta-bot: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.