CNFs RBAC¶

Overview¶

The Cloud-Native Network Functions (CNFs) BIG-IP Controller uses the default ServiceAccount to access the cluster API by default. To limit the resources and namespaces that the BIG-IP Controller can manage, the appropriate Kubernetes ServiceAccount and Role-based Access Control (RBAC) objects must be installed. Also, to specifiy which users can perform CNFs Helm installations, additional RBAC objects must be installed.

This document guides you through installing Kubernetes RBAC objects to limit BIG-IP Controller’s cluster API and namespace access.

API access¶

To grant minimal API access within a specified namespace to both the BIG-IP Controller and the user accounts that manage the BIG-IP Controller, the follwoing objects must be confiured and installed in the cluster:

Object	Description
`ServiceAccount`	A Pod-level account that binds the BIG-IP Controller to ClusterRole and Role objects.
`ClusterRole`	Grants minimal access to cluster-level resources, specifically the CNFs Custom Resource Definitions (CRDs).
`ClusterRoleBinding`	Binds the ServiceAccount and user accounts to the ClusterRole.
`Role`	Grants minilam access to resources within the specified namespace.
`RoleBinding`	Binds the ServiceAccount and user accounts to the Role.

Requirements¶

Ensure you have:

A working Robin cluster.
Installed the CNFs Software.

Procedures¶

Note: The full list of BIG-IP Controller RBAC objects can be downloaded here.

BIG-IP Controller¶

Create a serviceAccount

The serviceAccount required for installing the BIG-IP Controller can be created either manually or automatically. However, it is recommended to use only one of these methods (Create a serviceAccount manually or Create a serviceAccount using Helm). Ensure the serviceAccount is created prior to starting the BIG-IP Controller installation process.

Note: Use only one of the Create a serviceAccount manually and Create a serviceAccount using Helm processes to create a serviceAccount.

Create a serviceAccount and RBAC using Helm¶

You can create the serviceAccount required for the BIG-IP Controller automatically during installation by using Helm. This simplifies the process and ensures the serviceAccount is properly configured.

Enable the following parameters in the values.yaml file in BIG-IP controller (f5ingress).

rbac:
  create: true

controller:
  serviceAccount:
    name: cnf-service-account

Add the serviceAccount to the Project’s privileged security context constraint (SCC):
```
kubectl policy add-scc-to-user privileged -n <project> -z <serviceaccount>
```
In this example, the cnf-service-account serviceAccount is added to the cnf-gateway Project’s privileged SCC:
```
kubectl policy add-scc-to-user privileged -n cnf-gateway -z cnf-service-account
```

Create a serviceAccount manually¶

Following are the steps to configure and install the objects that allow minimal API access for the BIG-IP Controller.

Copy the ServiceAccount object into a YAML file, and adapt the metadata.name and metadata.namespace values for your environment:
```
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cnf-service-account
  namespace: cnf-gateway
```

Install the ServiceAccount object:

kubectl apply -f cnf-service-account.yaml

Verify the ServiceAccount has been created in the cluster:

In this example, the ServiceAccount named cnf-service-account has been created.

kubectl get sa -n cnf-gateway

NAME                   SECRETS 
default                1      
cnf-service-account    1     

Add the serviceAccount to the Project’s privileged security context constraint (SCC):
```
kubectl policy add-scc-to-user privileged -n <project> -z <serviceaccount>
```
In this example, the cnf-service-account serviceAccount is added to the cnf-gateway Project’s privileged SCC:
```
kubectl policy add-scc-to-user privileged -n cnf-gateway -z cnf-service-account
```

Copy the ClusterRole object for the service account into a YAML file, and adapt the metadata.name parameter for your environment:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cnf-sa-cluster-role
  # "namespace" omitted since ClusterRoles are not namespaced
rules:
- apiGroups:
  - admissionregistration.k8s.io
  resourceNames:
  - f5validate-default
  resources:
  - validatingwebhookconfigurations
  verbs:
  - get
  - update
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resourceNames:
  - f5-big-ips-policies.k8s.f5net.com
  - f5-big-pe-policies.k8s.f5net.com
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
  - update

Install the ClusterRole object:

kubectl apply -f cnf-sa-cluster-role.yaml

Verify the ClusterRole has been created in the cluster:
```
kubectl get clusterrole | grep cnf-sa-cluster-role
```
In this example, the ClusterRole named cnf-sa-cluster-role has been created.
```
cnf-sa-cluster-role
```

Copy the ClusterRoleBinding object into a YAML file, and adapt the metadata.name, metadata.namespace, subjects.name, and subjects.namespace values for your environment:

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cnf-sa-cluster-role-bind
  namespace: cnf-gateway
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnf-sa-cluster-role
subjects:
- kind: ServiceAccount
  name: cnf-service-account
  namespace: cnf-gateway

Install the ClusterRoleBinding object:

kubectl apply -f cnf-sa-cluster-role-bind.yaml

Verify the ClusterRoleBinding has been created in the cluster:

kubectl get clusterrolebinding -n cnf-gateway | grep  cnf-sa-cluster-role-bind

In this example, the ClusterRoleBinding named cnf-sa-cluster-role-bind has been created, and references the cnf-sa-cluster-role.

NAME                    ROLE                     
cnf-sa-cluster-role-bind   ClusterRole/cnf-sa-cluster-role

Copy the Role object for the service account into a YAML file, and adapt both the metadata.name and metadata.namespace values for your environment:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cnf-sa-role
  namespace: cnf-gateway
rules:
- apiGroups:
  - ""
  resources:
  - deployments
  - deployments/scale
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  - services
  verbs:
  - get
  - list
  - watch
  - update
  - patch
  - create
  - delete
- apiGroups:
  - ""
  resources:
  - endpoints
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods/status
  verbs:
  - get
  - update
  - patch
- apiGroups:
  - discovery.k8s.io
  resources:
  - endpointslices
  verbs:
  - list
  - watch
  - get
- apiGroups:
  - ingresstcp.k8s.f5net.com
  - ingressudp.k8s.f5net.com
  - k8s.f5net.com
  - dos.k8s.f5net.com
  - dns.k8s.f5net.com
  - gateway.networking.k8s.io
  - gateway.k8s.f5net.com
  - fic.f5.com
  resources:
  - '*'
  verbs:
  - watch
  - get
  - list
  - create
  - update
  - delete
  - patch
- apiGroups:
  - metrics.k8s.io
  resources:
  - pods
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - update
  - delete
  - patch
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - list
  - watch
  - create
  - update
  - delete
  - patch
  - deletecollection
- apiGroups:
  - apps
  - extensions
  resources:
  - deployments
  - deployments/scale
  - daemonsets
  - replicasets
  - statefulsets
  - ingresses
  verbs:
  - get
  - list
  - watch
  - create
  - delete
  - update
  - patch

Install the Role object:
```
kubectl apply -f cnf-sa-role.yaml
```
Verify the Role has been created in the cluster:
```
kubectl get role -n cnf-gateway | grep cnf-sa-role
```
In this example, the Role named cnf-sa-role has been created.
```
cnf-sa-role
```

Copy the RoleBinding object into a YAML file, and adapt the subjects.name, subjects.namespace, metadata.name, and metadata.namespace values for your environment:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cnf-sa-role-bind
  namespace: cnf-gateway
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cnf-sa-role
subjects:
- kind: ServiceAccount
  name: cnf-service-account
  namespace: cnf-gateway

Install the RoleBinding object:
```
kubectl apply -f cnf-sa-role-bind.yaml
```

Verify the RoleBinding has been created in the cluster:

kubectl get rolebinding -n cnf-gateway | grep  cnf-sa-role-bind

In this example, the RoleBinding named cnf-sa-role-bind has been created, and references the cnf-sa-role.

NAME               ROLE                     
cnf-sa-role-bind   ClusterRole/cnf-sa-role

Prior to installing the BIG-IP Controller, the following rbac.create and controller.serviceAccount Helm parameters must be configured:

In this example, the serviceAccount value cnf-service-account was configured in step 1 of this procedure.
```
rbac:
  create: false

controller:
  serviceAccount: 
    name: cnf-service-account
```

User accounts¶

Use these steps to configure and install the objects that allow minimal API access for the cluster user accounts.

Note: The full list of user account RBAC objects can be downloaded here.

Copy the ClusterRole object for the user accounts into a YAML file, and adapt the metadata.name parameter for your environment:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cnf-user-cluster-role
  # "namespace" omitted since ClusterRoles are not namespaced
rules:
- apiGroups:
  - admissionregistration.k8s.io
  resourceNames:
  - f5validate-default
  resources:
  - validatingwebhookconfigurations
  verbs:
  - get
  - update
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apiextensions.k8s.io
  resourceNames:
  - f5-big-ips-policies.k8s.f5net.com
  - f5-big-pe-policies.k8s.f5net.com
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - list
  - watch
  - update

Install the ClusterRole object:

kubectl apply -f cnf-user-cluster-role.yaml

Verify the ClusterRole has been created in the cluster:
```
kubectl get clusterrole | grep cnf-user-cluster-role
```
In this example, the ClusterRole named cnf-user-cluster-role has been created.
```
cnf-user-cluster-role
```

Copy the RoleBinding object into YAML file, and adapt the metadata.name, metadata.namespace, and subjects.name values for your environment:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cnf-user-clusterrole-bind
  namespace: cnf-gateway
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cnf-user-cluster-role
subjects:
- apiGroup: rbac.authorization.k8s.io 
  kind: User  
  name: john.williams
- apiGroup: rbac.authorization.k8s.io 
  kind: User  
  name: mary.jones

Verify the RoleBinding has been created in the cluster:
```
kubectl get rolebinding -n cnf-gateway | grep  cnf-user-clusterrole-bind
```
In this example, the RoleBinding named cnf-user-clusterrole-bind has been created, and references the cnf-user-cluster-role.
```
cnf-user-clusterrole-bind   ClusterRole/cnf-user-cluster-role 
```

Copy the Role object for the user accounts into a YAML file, and adapt the metadata.name and metadata.namespace parameters for your environment:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cnf-user-role
  namespace: cnf-gateway
rules:
- apiGroups:
  - "" # "" indicates the core API group
  resources:
  - pods
  - pods/log
  - pods/exec
  - pods/status
  - services
  - services/finalizers
  - endpoints
  - persistentvolumeclaims
  - events
  - configmaps
  - secrets
  - resourcequotas
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
  - deletecollection
- apiGroups:
  - apps
  - extensions
  resources:
  - deployments
  - deployments/scale
  - daemonsets
  - replicasets
  - statefulsets
  - ingresses
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - monitoring.coreos.com
  resources:
  - servicemonitors
  verbs:
  - get
  - create
- apiGroups:
  - metrics.k8s.io
  resources:
  - pods
  - nodes
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - k8s.f5net.com
  - dos.k8s.f5net.com
  - dns.k8s.f5net.com
  resources:
  - '*' # asterisk to grant access to all resources of the specified api groups
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - rbac.authorization.k8s.io
  resources:
  - roles
  - rolebindings
  verbs:
  - get
  - watch
  - list
- apiGroups:
  - ""
  resources:
  - serviceaccounts
  verbs:
  - impersonate
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch

Install the Role object:
```
kubectl apply -f cnf-user-role.yaml
```
Verify the Role has been created in the cluster:

In this example, the Role named cnf-user-role has been created.
```
kubectl get role -n cnf-gateway | grep cnf-user-role
```
In this example, the Role named cnf-user-role has been created.
```
cnf-user-role
```

Copy the RoleBinding into a YAML file, and adapt the metadata.name, and metadata.namespace, and subjects.name parameters for your environment:

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cnf-user-role-bind
  namespace: cnf-gateway
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cnf-user-role
subjects:
- apiGroup: rbac.authorization.k8s.io 
  kind: User  
  name: john.williams
- apiGroup: rbac.authorization.k8s.io 
  kind: User  
  name: mary.jones

Install the RoleBinding object:

kubectl apply -f cnf-user-role-bind.yaml

Verify the RoleBinding has been created in the cluster:

kubectl get rolebinding -n cnf-gatewway | grep  cnf-user-role-bind

In this example, the RoleBinding named cnf-user-role-bind has been created, and references the cnf-user-role.

NAME                 ROLE                     
cnf-user-role-bind   Role/cnf-user-role

The specified users can now install the BIG-IP Controller using Helm.

Cluster-wide RBAC for CNF components¶

The RBAC for a majority of the CNF components is currently set to no or minimal cluster-wide access. However, there are a few CNF components that require cluster-wide access, or privileges under certain circumstances. For more information on the CNFs components that require cluster-wide access, see Cluster-wide RBACs for CNFs.

Next step¶

Continue to one of the following guides listed by installation precedence:

Required: Install the Fluentd Logging collector to centralize CNF container logging.
Optional: Install the dSSM Database to store session-state information.
Required: Install the BIG-IP Controller, Edge Firewall and TMM Pods.

Feedback¶

Provide feedback to improve this document by emailing cnfdocs@f5.com.