Repository navigation
docs(book): install Kates for compliance checks, with or without cluster admin - #569
Merged
Merged
Conversation
… cluster admin A new section walks a team with edit in its own namespace through checking a Kafka cluster it doesn't administer, on any Kubernetes cluster: the owner's read-only Role and optional node grant, a plain Helm install with rbac.scope=namespace and the values that name the cluster, reaching the API with kates ports, and what the namespace scope changes in a report.
Every command ran on an admin-less Kind lab: a second Kates installed into payments from an account with edit there, the owner's KafkaUser, Role and node grant applied as written. The section now shows the KafkaUser with the ACLs a check needs, who does what, a figure of the grants, the real outputs (lint, check, the 503 before the Role, the zone detail), what the node grant changes, a Try it and how to remove it, on the lab's real names. The run found the Kates API polls its dead-letter queue as the group kates-dlq-consumer, which the Deployment Guide's ACL list left out.
The section becomes Installing Kates for Compliance Checks: a table of the two installs, the KafkaUser both need, With Cluster Admin (kates deploy, or the chart's default rbac.scope=cluster on a running Kafka, zones and PodMonitors read cluster-wide, and the ClusterRole's chaos writes a check never uses) and Without Cluster Admin, the tested admin-less steps. The admin outputs come from a cluster-scope install on the same Kind lab.
bmscomp
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The compliance chapter gains Installing Kates for Compliance Checks. It opens with a table comparing the two installs and a shared KafkaUser. The KafkaUser comes with the ACLs a check needs and the Kates API's own topics and groups. Then there are two subsections.
With Cluster Admin
kates deployfor the whole stack. On a Kafka cluster that's already running, the chart's defaultrbac.scope=cluster, with the password copied from Strimzi's Secret.zoneLabelworks, and PodMonitors in every namespace.Without Cluster Admin, in four steps:
rbac.scope=namespace.The section ends with a Try it and how to remove the install.
Tested on the admin-less Kind lab:
paymentsinstall from an account witheditonly.Both used the commands as written, and every output in the section comes from those runs.
Fix in the Deployment Guide. The ACL list gains Read on the group
kates-dlq-consumer. Without it, the Kates API logged aGroupAuthorizationExceptionabout every 30 seconds.scripts/check-book-style.shpasses, and the new figure renders withmmdc. CI renders the book.