diff --git a/app/kubernetes/__module.js b/app/kubernetes/__module.js index f3edc768d..54c3b5507 100644 --- a/app/kubernetes/__module.js +++ b/app/kubernetes/__module.js @@ -374,8 +374,8 @@ angular.module('portainer.kubernetes', ['portainer.app', registriesModule, custo }; const endpointKubernetesSecurityConstraint = { - name: 'kubernetes.cluster.securityConstraint', - url: '/securityConstraint', + name: 'kubernetes.security', + url: '/security', views: { 'content@': { templateUrl: '../kubernetes/views/security-constraint/constraint.html', diff --git a/app/kubernetes/views/security-constraint/constraint.html b/app/kubernetes/views/security-constraint/constraint.html index a55668d73..6c7bb9ae6 100644 --- a/app/kubernetes/views/security-constraint/constraint.html +++ b/app/kubernetes/views/security-constraint/constraint.html @@ -1,10 +1,10 @@ @@ -12,29 +12,73 @@
-
-
- - - -
- -
-
- +
+
+
+ + + +
+
+
+
+ Kubernetes authorization generally uses + role based access control (RBAC) to determine if a + user or process has the permissions to access or perform certain actions within the cluster. +
+
+
The Cluster Roles and Roles screens (under this Security sub-menu) list the resources where permissions are defined in your cluster, and the + Bindings that grant those permissions to subjects (Users, Groups and Service Accounts). The Service Accounts screens lists existing identities (typically + for a Pod or set of Pods).
-
- - - + + +
+
+
+ +
+
+
+
+ + + +
+ +
+
+

+ + You may configure privilege and access control settings for Pods in your cluster. +

+
+
+ + +
+
+
+ + +
diff --git a/app/kubernetes/views/security-constraint/constraintController.js b/app/kubernetes/views/security-constraint/constraintController.js index d8a8b94cf..344514444 100644 --- a/app/kubernetes/views/security-constraint/constraintController.js +++ b/app/kubernetes/views/security-constraint/constraintController.js @@ -7,6 +7,7 @@ angular.module('portainer.kubernetes').controller('KubernetesSecurityConstraintC 'EndpointService', function ($scope, EndpointProvider, EndpointService) { $scope.limitedFeaturePodSecurityPolicy = FeatureId.POD_SECURITY_POLICY_CONSTRAINT; + $scope.limitedFeatureAccessControl = FeatureId.K8S_ACCESS_CONTROL; $scope.state = { viewReady: false, actionInProgress: false, diff --git a/app/react/portainer/feature-flags/enums.ts b/app/react/portainer/feature-flags/enums.ts index df372429c..59dc10a4c 100644 --- a/app/react/portainer/feature-flags/enums.ts +++ b/app/react/portainer/feature-flags/enums.ts @@ -39,4 +39,5 @@ export enum FeatureId { K8S_ADM_ONLY_USR_INGRESS_DEPLY = 'k8s-admin-only-ingress-deploy', K8S_ROLLING_RESTART = 'k8s-rolling-restart', K8S_ANNOTATIONS = 'k8s-annotations', + K8S_ACCESS_CONTROL = 'k8s-security', } diff --git a/app/react/portainer/feature-flags/feature-flags.service.ts b/app/react/portainer/feature-flags/feature-flags.service.ts index b3943bcb2..ab5bb5d23 100644 --- a/app/react/portainer/feature-flags/feature-flags.service.ts +++ b/app/react/portainer/feature-flags/feature-flags.service.ts @@ -44,6 +44,7 @@ export async function init(edition: Edition) { [FeatureId.K8S_ADM_ONLY_USR_INGRESS_DEPLY]: Edition.BE, [FeatureId.K8S_ROLLING_RESTART]: Edition.BE, [FeatureId.K8S_ANNOTATIONS]: Edition.BE, + [FeatureId.K8S_ACCESS_CONTROL]: Edition.BE, }; state.currentEdition = currentEdition; diff --git a/app/react/portainer/feature-flags/feature-ids.js b/app/react/portainer/feature-flags/feature-ids.js index b03093729..df9b7dff3 100644 --- a/app/react/portainer/feature-flags/feature-ids.js +++ b/app/react/portainer/feature-flags/feature-ids.js @@ -16,3 +16,4 @@ export const STACK_PULL_IMAGE = 'stack-pull-image'; export const STACK_WEBHOOK = 'stack-webhook'; export const CONTAINER_WEBHOOK = 'container-webhook'; export const K8S_ANNOTATIONS = 'k8s-annotations'; +export const K8S_ACCESS_CONTROL = 'k8s-security'; diff --git a/app/react/sidebar/KubernetesSidebar/KubernetesSidebar.tsx b/app/react/sidebar/KubernetesSidebar/KubernetesSidebar.tsx index b125cc57e..9182fdb5c 100644 --- a/app/react/sidebar/KubernetesSidebar/KubernetesSidebar.tsx +++ b/app/react/sidebar/KubernetesSidebar/KubernetesSidebar.tsx @@ -1,4 +1,4 @@ -import { Box, Edit, Layers, Lock, Server, Shuffle } from 'lucide-react'; +import { Box, Edit, Layers, Lock, Server, Shuffle, Shield } from 'lucide-react'; import { EnvironmentId } from '@/react/portainer/environments/types'; import { Authorized } from '@/react/hooks/useUser'; @@ -100,6 +100,20 @@ export function KubernetesSidebar({ environmentId }: Props) { data-cy="k8sSidebar-volumes" /> + + + + - - - -