Access control

You can assign access rights to users or user groups for a cluster namespace from the Access control page of that namespace.

Under Administration in the namespace, the Access control page has three tabs:

From the namespace Access control page, users with the required permissions can:

• Create, change, and delete access assignments for users or groups in the current namespace.
• View platform-level and cluster-level access assignments for users and groups that have access to this namespace. Read-only entries are not clickable.

The access assignment status model in the namespace reflects how assignments are applied for users and groups with namespace access:

• The Application status in the management cluster block groups assignment application results in the management cluster itself*.
• The Application status in client clusters block shows whether access was applied successfully in the cluster and whether roles were applied in Argo CD. At the Platform level, a ratio shows clusters where the assignment was applied successfully versus the total number of clusters. Other levels use color indicators for assignment success.

Color indicators:

• Green: applied successfully.
• Red: errors occurred while applying access.
• Gray: application not required. This can happen when the access bundle did not request access rights, for example in Argo CD.

*The management cluster manages some objects in client clusters, for example objects in API groups cluster.x-k8s.io, bootstrap.cluster.x-k8s.io, infrastructure.cluster.x-k8s.io, and permissions.shturval.tech. At each access level, platform permissions are required in the access bundle to obtain such objects. That is why assignment statuses may show application in the management cluster even when the assigned permissions relate to a cluster or namespace.

Assigning access to a user group #

To assign access to a user group, open the Namespace tab and click +. On the screen that opens:

The Assign access to group form appears

• You can set the group name in one of two ways:

Method 1

Select from directory connected during LDAP integration (for example, AD or OpenLDAP). Directory selection is available only when LDAP integration is configured in the platform.

• In the Group name field, start typing the group name. Search runs from the second character.

• Search returns a list of group names.

• Select the required group from the list (directory search is case-insensitive). If the directory is not connected, you can enter the group name manually.

Method 2

Enter the group name manually. Select Manual entry and enter the user group name in Group name. Use this method when an external authentication provider (for example, Keycloak or Blitz) is connected to the platform. If the group name is entered manually, LDAP directory search is not performed.

• After the group name is set, select the access bundles to assign to the group and click Save.

All users in the group receive the assigned permissions.

The group name cannot be edited after the record is created. To change it, delete the record and create a new one.

Assigning access to a user #

To assign access to a user, open the Namespace tab and click +:

The Assign access form appears

You can set the user name in one of two ways:

Method 1

Use the directory connected during LDAP integration (for example, AD or OpenLDAP). Directory selection is available only when LDAP integration is configured in the platform.

• In the Unique user name field, start typing the user name. Search runs from the second character. Results show users whose names contain the entered characters.

• Select a user from the list (directory search is case-insensitive). If the directory is not connected, you can enter the user name manually.

Method 2

Enter the user name manually. Select Manual entry and enter the user name in Unique user name. Use this method when an external authentication provider (for example, Keycloak or Blitz) is connected to the platform. If the user name is entered manually, LDAP directory search is not performed.

When Unique user name is filled in:

• Select the access bundles to assign to the user, then click Save. The user name cannot be edited after the record is created. To change it, delete the record and create a new one.

For more about access bundles available for assignment.

Note!

If a namespace-level access bundle includes an Argo CD role, assigning that bundle to a group or user grants access to the Argo CD project of only one namespace.