Managing users on AKS

For installations on Azure Kubernetes Service , you add users and assign roles by using Kubernetes secrets. Users and roles that you assign by following this procedure are only applicable to the Platform UI.

To learn how identity and access management is done for other instance types on Kubernetes distributions such as AKS , see the documentation for its respective product. For example, for roles that are applicable to an App Connect dashboard, see the App Connect documentation.

Local auth

You can use local authentication to define users and roles explicitly in Kubernetes secrets on the AKS cluster.

Authentication

Usernames and password are stored in a secret named <NAME>-platform-ui-authentication, where <NAME> is the name of the Platform UI instance.

Only users with permissions to manage Kubernetes secrets in the namespace where the Platform UI is deployed can manage authentication.

Log in to your AKS cluster as a namespace administrator.
Set the name and the namespace (placeholders <name> and <namespace>) for the Platform UI:
```
NAME=<name>
NAMESPACE=<namespace>
```

Edit the secret.

Extract the secret to a local file:

kubectl get secret/${NAME}-platform-ui-authentication -n ${NAMESPACE} \
   -o go-template='{{index .data "authentication.yaml" | base64decode}}' \
   > authentication.yaml

Update the configuration values in authorization.yaml. For example, take the following authorization.yaml:

users:
- username: integration-admin
  password: password-for-integration-admin-here

And update to add a new user by changing to:

users:
- username: integration-admin
  password: password-for-integration-admin-here
- username: example
  password: password-for-example-here

Save your updates to the secret:
```
kubectl create secret generic ${NAME}-platform-ui-authentication -n ${NAMESPACE} \
   --save-config --dry-run=client --from-file=./authentication.yaml \
   -o yaml | kubectl apply -f -
```
The updated secret is automatically picked up by the Platform UI, and you can now log in with this user. However, you do not have access until someone assigns roles to the user. Follow the procedure in the next section ("Authorization").

Authorization

After configuring authentication to your Platform UI, the next step is to specify roles for your users to determine their permissions. The role names are the same used by Keycloak when installing OpenShift, as documented under "Client roles for the Cloud Pak installation" in Cloud Pak roles and permissions.

The permissions that each user has are stored in a secret named <NAME>-platform-ui-authorization, where <NAME> is the name of the Platform UI instance.

Only users with permissions to manage Kubernetes secrets in the namespace of the Platform UI can manage authorization.

Use the kubectl command to get the secret from the namespace.

Log in to your AKS cluster as a namespace administrator.
Set the name and the namespace (placeholders <name> and <namespace>) for the Platform UI:
```
NAME=<name>
NAMESPACE=<namespace>
```

Edit the secret.

Extract the secret to a local file:

kubectl get secret/${NAME}-platform-ui-authorization -n ${NAMESPACE} \
   -o go-template='{{index .data "authorization.yaml" | base64decode}}' \
   > authorization.yaml

Update the configuration values in authorization.yaml, including roles. For example:
```
users:
- username: integration-admin
  roles:
   - admin
```
And update to add roles for a new user by changing to:
```
users:
- username: integration-admin
  roles:
   - admin
- username: example
  roles:
   - viewer
   - policy-admin
   - policybinding-admin
```
This allows the example user to view all instances and to create, edit, and delete Policy and Policy Binding instances.

Save your updates to the the secret:

kubectl create secret generic ${NAME}-platform-ui-authorization -n ${NAMESPACE} \
   --save-config --dry-run=client --from-file=./authorization.yaml \
   -o yaml | kubectl apply -f -

The changed secret is automatically picked up by the Platform UI, and you can now log in with this user.