Identity and Access Management

Identity and Access Management: Component for managing user and service account access to Stackland resources. Identity and Access Management implements centralized authentication and authorization in all platform services.

Main featuresMain features

User managementUser management

Identity and Access Management supports multiple user management options:

• Local users: Users are created and managed directly in Identity and Access Management. This option is best suited for smaller teams or test environments.
• External IdPs: Integration with corporate user management systems over SAML. This enables you to use the existing authentication infrastructure.

Group managementGroup management

Groups streamline access management for user teams. With Identity and Access Management, you can:

• Create local groups in Identity and Access Management.
• Manage user memberships in groups.
• Map external IdP groups to internal groups.
• Assign roles to groups instead of individual users.

Access managementAccess management

Identity and Access Management provides a flexible access management system:

• Roles: Comprise permissions to perform operations on resources.
• Assigning roles: Grant roles to users, groups, and service accounts at various levels:
  • Organization level: For access to all resources.
  • Project level: For access to resources in a specific namespace.
  • Service account level: For access to service resources.

Service accountsService accounts

Service accounts are used for automation and cross-service communication:

• Creating service accounts for applications and services.
• Generating API keys for authentication.
• Assigning roles to service accounts.
• Integration with Kubernetes ServiceAccount.

Getting startedGetting started

First loginFirst login

Deploying the platform automatically creates an administrator with the admin@stackland username. The temporary password is stored in the admin-password secret within the stackland-secrets project. Change the password on first login.

Creating usersCreating users

There are two ways the administrator can create new users:

1. Create a local user directly in the Identity and Access Management web interface.
2. Set up a connection to an external SAML IdP. Users will be created automatically the first time they log in.

Assigning rolesAssigning roles

After creating a user, you can assign them roles at different levels:

• Organization, to access all platform resources.
• Project, to access resources within a specific namespace.
• Service account, to access service-specific resources.

Use casesUse cases

Creating a local userCreating a local user

Local users are created via the IAM API. To create a user, specify the following:

• Username in username@stackland format
• User’s full name
• Name
• Last name
• Email
• Password

Once created, the user can log in to the system with the credentials you specified.

Assigning a role at the organization levelAssigning a role at the organization level

To assign an organization-level role to a user, provide the ClusterAccessBinding resource:

apiVersion: iam.stackland.yandex.cloud/v1alpha1
kind: ClusterAccessBinding
metadata:
  name: user-admin-role
spec:
  # Role to assign
  roleID: "admin"
  # Subject getting the role
  subject:
    kind: User
    name: "username@stackland"

Where:

• roleID: IAM role ID, e.g., admin, editor, or viewer. This is a required field. It must match an existing role in Identity and Access Management.
• subject: Subject the role is assigned to. This is a required field.
  • kind: Subject type. The valid values are User, Group, ServiceAccount, and FederatedUser. This is a required field.
  • name: Subject name. For users, specify their username from Identity and Access Management. This is a required field.

Assigning a role to a groupAssigning a role to a group

To assign a role to a user group, also use the ClusterAccessBinding resource and specify the Group subject type:

apiVersion: iam.stackland.yandex.cloud/v1alpha1
kind: ClusterAccessBinding
metadata:
  name: stackland-cluster-admins
spec:
  roleID: admin
  subject:
    kind: Group
    name: stackland-cluster-admins

Where:

• roleID: IAM role ID. This is a required field.
• subject.kind: Group subject type to assign the role to a group. This is a required field.
• subject.name: Group name in Identity and Access Management. This is a required field.

Assigning a role at the namespace levelAssigning a role at the namespace level

To assign a role at the namespace level, use the AccessBinding resource:

apiVersion: iam.stackland.yandex.cloud/v1alpha1
kind: AccessBinding
metadata:
  name: bob-is-storage-admin
  namespace: warehouse
spec:
  roleID: storage.admin
  subject:
    kind: User
    name: bob@stackland

Description of fields:

• metadata.namespace: Namespace to assign the role at its level. The role will be assigned for this project’s folder. This is a required field.
• roleID: IAM role ID. This is a required field.
• subject: Subject the role is assigned to. This is a required field.
  • kind: Subject type. The valid values are User, Group, ServiceAccount, and FederatedUser. This is a required field.
  • name: Subject name. This is a required field.

Assigning a role to a service accountAssigning a role to a service account

To assign a role to a service account, specify the ServiceAccount subject type and the project where the service account resides:

apiVersion: iam.stackland.yandex.cloud/v1alpha1
kind: AccessBinding
metadata:
  name: sa-storage-admin
  namespace: my-namespace
spec:
  roleID: "storage.admin"
  subject:
    kind: ServiceAccount
    name: "my-service-account"
    namespace: "my-namespace"

Where:

• metadata.namespace: Project to assign the role at its level. This is a required field.
• roleID: IAM role ID. This is a required field.
• subject: Subject the role is assigned to. This is a required field.
  • kind: ServiceAccount subject type. This is a required field.
  • name: Kubernetes ServiceAccount name. This is a required field.
  • namespace: Project the ServiceAccount is located in. This is a required field for the ServiceAccount subject type.

Configuring an external IdPConfiguring an external IdP

apiVersion: iam.stackland.yandex.cloud/v1alpha1
kind: SAMLFederation
metadata:
  name: corporate-idp
spec:
  # Federation description
  description: "Corporate Identity Provider"
  # Identity provider URL
  issuer: "https://idp.company.com/realms/main"
  # Single sign-on URL
  ssoUrl: "https://idp.company.com/realms/main/protocol/saml"
  # SAML binding type
  ssoBinding: POST
  # Automatically create users on first login
  autoCreateAccountOnLogin: true
  # Session cookie lifetime
  cookieMaxAge: "12h"
  # Certificates for verification of SAML response signatures
  certificates:
    - name: "idp-signing-cert"
      description: "IdP signing certificate"
      data: |
        -----BEGIN CERTIFICATE-----
        ...
        -----END CERTIFICATE-----
  # Mapping external to internal groups
  groupMapping:
    enabled: true
    mapping:
      - externalId: "idp-admins"
        internalName: "stackland-cluster-admins"
      - externalId: "idp-developers"
        internalName: "developers"