Setting service accounts and role-based access control on Kubernetes

For db2u instances deployed on a Kubernetes cluster version 1.25 and later, users need to apply Pod Security Admission (PSA) labels to their dedicated working namespaces rather than PodSecurityPolicy (PSP).

About this task

To grant limited privileges to db2u pods, users need to customize their own serviceAccount (SA) and role-based access control (RBAC) bindings. If users do not specify a SA, the Db2 Operator will automatically generate the SA and assign the required resource accessibility.

PodSecurityPolicy (PSP) is officially deprecated in Kubernetes version 1.25 and later. PSP is replaced by Pod Security Admission (PSA). For db2u instances deployed on a Kubernetes cluster version 1.25 and later, users need to apply PSA labels to their dedicated working namespace.

Based on the official Kubernetes wiki on pod security levels, Kubernetes users currently have three privilege levels. Db2u requires the privileged level to work. The privileged level is unrestricted and provides the widest possible level of permissions.

To apply the PSA label, assign the enforced=privileged level to your Db2u namespace:

kubectl label ns <db2u-namespace> pod-security.kubernetes.io/enforce=privileged

To review the labels you have updated, run this command:

kubectl get ns --show-labels

Procedure

Apply restricted RBAC using customized SA: To apply a specific RBAC, you need to customize your SA, Role Policy, and role-binding. You do not have to specify your own SA, the Db2 Operator will automatically generate the SA and assign default resource accessibility.
Set SERVICE_ACCOUNT to the name of the service account that you want to use:
```
export SERVICE_ACCOUNT=<sa-name>
```
Set ROLEBINDING_NAMEto the name of the role-binding that will be used to bind the service account:
```
export ROLEBINDING_NAME=<rolebinding-name>
```
Set PROJECT_NAMESPACE to the project namespace in which the Db2 service is installed:
```
export PROJECT_NAMESPACE=<namespace>
```

Create your customized SA:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ${SERVICE_ACCOUNT}
  namespace: ${PROJECT_NAMESPACE}
EOF

Create the Roles. The following role settings are the minimum requirements for Db2 to fully function.

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ${ROLE_NAME}
  namespace: ${PROJECT_NAMESPACE}
rules:
- apiGroups:
  - ""
  resources:
  - endpoints
  - pods
  verbs:
  - get
  - patch
  - update
- apiGroups:
  - apps
  resources:
  - statefulsets
  - deployments
  - replicasets
  verbs:
  - get
  - list
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - get
  - patch
  - watch
  - list
  - update
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - get
  - create
  - update
- apiGroups:
  - db2u.databases.ibm.com
  resources:
  - recipes
  verbs:
  - watch
  - get
  - update
  - create
  - patch
  - list
  - delete
- apiGroups:
  - db2u.databases.ibm.com
  resources:
  - buckets
  verbs:
  - patch
- apiGroups:
  - db2u.databases.ibm.com
  resources:
  - backups
  verbs:
  - patch
  - delete
  - list
- apiGroups:
  - db2u.databases.ibm.com
  resources:
  - formations
  verbs:
  - get
- apiGroups:
  - ""
  resources:
  - pods/exec
  verbs:
  - create
- apiGroups:
  - ""
  resources:
  - pods
  verbs:
  - watch
  - list
  - get
- apiGroups:
  - ""
  resources:
  - services
  verbs:
  - watch
  - list
  - get
EOF

Create role-binding with the SA and Role:

cat <<EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ${ROLEBINDING_NAME}
  namespace: ${PROJECT_NAMESPACE}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: ${ROLE_NAME}
subjects:
- kind: ServiceAccount
  name: ${SERVICE_ACCOUNT}
  namespace: ${PROJECT_NAMESPACE}
EOF

Deploy the instance with the predefined SA:

apiVersion: db2u.databases.ibm.com/v1
kind: Db2uCluster
metadata:
  name: db2-test
  namespace: ${PROJECT_NAMESPACE}
spec:
  size: 1
  account: 
    serviceAccountName: ${SERVICE_ACCOUNT}
...