Assign a role for debugging

If a cluster issue requires elevated user permissions (for example, a pod does not start or restarts frequently without an obvious reason), you can assign the user a temporary role (access set).

To elevate permissions, assign an additional role (access set) with more permissions. For example, a user has the system access set dev-basic, which allows only viewing workload objects. To resolve the issue, permissions must be elevated to the level of modifying workload objects. You can:

• temporarily assign the system access set dev-debugger;
• temporarily assign a custom access set;
• remove the access set assignment after the issue is resolved.

Assigning an additional temporary access set lets you quickly grant permissions and restrict them again after the issue is resolved. Creating a new access set is recommended because changing an existing access set changes access rights for all users and groups it is assigned to.

A Shturval platform administrator can create and modify access set permissions. A user with cluster or namespace role management rights can assign roles (access sets).

Permissions in the dev-debugger system access set #

In the Shturval platform, the dev-debugger access set grants permissions for debugging workloads. You can review the full list of permissions in the access set.

In the platform UI:

• go to the Access Manager page;

• find the dev-debugger access set and open the access set permissions view page.

- apiGroups:
  - ""
  resources:
  - namespaces
  verbs:
  - get # Get namespaces
  - list # List namespaces
  - watch # Watch namespaces
- apiGroups:
  - ""
  resources:
  - namespaces/status
  - events
  verbs:
  - get # Get namespace statuses and events
  - list # List namespace statuses and events
  - watch # Watch namespace statuses and events

- apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get # Get pods and pod logs
  - list # List pods and pod logs

- apiGroups:
  - ""
  resources:
  - pods/portforward 
  - pods/exec 
  verbs:
  - create # Create a secure tunnel between the local machine and a pod
  - get  # Execute commands in a pod container

- apiGroups:
  - aquasecurity.github.io
  resources:
  - configauditreports
  verbs:
  - get 
  - list
  - watch
- apiGroups:
  - aquasecurity.github.io
  resources:
  - vulnerabilityreports
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - wgpolicyk8s.io
  resources:
  - policyreports
  - clusterpolicyreports
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - kyverno.io
  resources:
  - admissionreports
  - clusteradmissionreports
  - backgroundscanreports
  - clusterbackgroundscanreports
  verbs:
  - get
  - list
  - watch

- apiGroups:
  - events.k8s.io/v1
  resources:
  - events
  verbs:
  - get # Get events
  - list # List events
  - watch # Watch events

The dev-debugger access set includes the Platform permission cluster-get, which is required to grant cluster access. This permission lets the UI request objects inside the cluster, for example, a cluster namespace.

rules:
  - verbs:
      - get # Get the cluster
    apiGroups:
      - cluster.x-k8s.io
    resources:
      - clusters
  - verbs:
      - get # Get the namespace
      - list # List namespaces
    apiGroups:
      - ''
    resources:
      - namespaces

If the access set contains excessive or missing permissions, you can create a custom access set.

Assigning a role (access set) using dev-debugger as an example #

1. In the UI, go to the Access Control page in the Administration section.

2. On the Namespace tab of the Access Control page, add a user or open the Access rights assignment page for a user from the list.

On the Access rights assignment page:

• specify a name if you are adding a user;
• select the dev-debugger access set from the list.

3. Save the role (access set) assignment to the user.

Example of creating and assigning a custom access set #

Suppose you need to grant a user fewer permissions than the system access set dev-debugger provides. Create a custom access set.

1. In the platform, on the Access Manager page in the Access Management section, create a Namespace-level access set, for example, named debug.

2. Configure the access set:

• On the Cluster permissions tab, specify rules in YAML format containing the API group (apiGroups), verbs (verbs), and resources (resources) to which rights are assigned.

- apiGroups:
  - ""
  resources:
  - namespaces
  - events
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - pods
  - pods/log
  verbs:
  - get
  - list
- apiGroups:
  - ""
  resources:
  - pods/exec
  verbs:
  - create
  - get

• On the Platform permissions tab, select the cluster access permission cluster-get.

Add the new access set to the platform by clicking Save.

3. Go to the Access Control page in the Administration section in the cluster or namespace.

4. On the Namespace tab of the Access Control page, add a user or open the Access rights assignment page for a user from the list.

On the Access rights assignment page:

• specify a name if you are adding a user;
• select the created debug access set from the list.

5. Save the access set assignment to the user.

As a result of assigning the debug access set, the user is granted:

• access to pods in the cluster namespace;
• access to container logs of pods in the cluster namespace;
• rights to execute commands in a pod container;
• access to namespace object events.