Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AV-196862 update multitenancy doc #240

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 8 additions & 7 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -20,16 +20,17 @@ AMKO is aware of the following object types:
For Kubernetes clusters:
| **Components** | **Version** |
| -------------- | ----------- |
| Kubernetes | 1.23-1.27 |
| AKO | 1.13.1 |
| AVI Controller | 21.1.6 - 30.1.1 |
| Kubernetes | 1.25-1.29 |
| AKO | 1.12.1 |
| AVI Controller | 22.1.3 - 30.2.1 |

For openshift clusters:
| **Components** | **Version** |
| -------------- | ----------- |
| Openshift | 4.10-4.13 |
| AKO | 1.13.1 |
| AVI Controller | 21.1.6 - 30.1.1 |
| Openshift | 4.12-4.14 |
| AKO | 1.12.1 |
| AVI Controller | 22.1.3 - 30.2.1 |


#### Pre-requisites
To kick-start AMKO, we need:
Expand Down Expand Up @@ -159,7 +160,7 @@ kubectl apply -f <output_dir>/amko/crds/
helm list -n avi-system

NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION
amko-1598451370 avi-system 1 2023-06-19 10:00:31.609195757 +0000 UTC deployed amko-1.10.1 1.10.1
amko-1598451370 avi-system 1 2023-10-19 10:00:31.609195757 +0000 UTC deployed amko-1.11.1 1.11.1
```

*Step4*
Expand Down
2 changes: 1 addition & 1 deletion docs/amko_tenancy.md
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ In this example we will run AMKO in `billing` tenant.
| `GSLB configuration` | Read access to everything in the GSLB configuration relevant to the tenant |
| `GSLB services` | Write access to all GSLB services in all tenants to which this user is assigned |
| `GSLB geolocation database` | Read access to geolocation database |
* To achieve this AMKO User can be assigned [`amko-tenant`](roles/amko-tenant.json) role in the `billing` tenant.
* To achieve this AMKO User should be assigned [`amko-tenant`](roles/amko-tenant.json) role in the `billing` tenant and [`amko-admin`](roles/admin-tenant.json) in the admin tenant.
### 3. AMKO installation

* In **AMKO**, Set the `configs.tenant` field in values.yaml to the tenant `billing` created in the earlier steps.
Expand Down
2 changes: 2 additions & 0 deletions docs/crds/gdp.md
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,8 @@ spec:
- my-health-monitor1

sitePersistenceRef: gap-1

pkiProfileRef: pki-1

poolAlgorithmSettings:
lbAlgorithm: GSLB_ALGORITHM_ROUND_ROBIN
Expand Down
2 changes: 2 additions & 0 deletions docs/crds/gslbhostrule.md
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,8 @@ spec:
sitePersistence:
enabled: true
profileRef: "gap-1" # only enabled for secure ingresses/routes
pkiProfileRef: "pki-1"

thirdPartyMembers:
- site: non-avi-site
vip: 10.10.10.10
Expand Down
250 changes: 250 additions & 0 deletions docs/roles/admin-tenant.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,250 @@
{
"name": "amko-admin",
"allow_unlabelled_access": true,
"privileges": [
{
"resource": "PERMISSION_VIRTUALSERVICE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_POOL",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_POOLGROUP",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_GSLBSERVICE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_GSLB",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_CLOUD",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_SERVICEENGINE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_SERVICEENGINEGROUP",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_NETWORK",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_GSLBGEODBPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_VRFCONTEXT",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_APPLICATIONPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_NETWORKPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_APPLICATIONPERSISTENCEPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_HEALTHMONITOR",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_ANALYTICSPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_IPAMDNSPROVIDERPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_CUSTOMIPAMDNSPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_TRAFFICCLONEPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_NATPOLICY",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_L4POLICYSET",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_HTTPPOLICYSET",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_NETWORKSECURITYPOLICY",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_AUTOSCALE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_DNSPOLICY",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_IPADDRGROUP",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_STRINGGROUP",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_SSLKEYANDCERTIFICATE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_SSLPROFILE",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_PKIPROFILE",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_AUTHPROFILE",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_PINGACCESSAGENT",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_CERTIFICATEMANAGEMENTPROFILE",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_HARDWARESECURITYMODULEGROUP",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is READ access required here? Does AMKO-admin do any operations related to it?

"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_SSOPOLICY",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_VSDATASCRIPTSET",
"type": "WRITE_ACCESS"
},
{
"resource": "PERMISSION_PROTOCOLPARSER",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_WAFPOLICY",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_WAFPROFILE",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_WAFPOLICYPSMGROUP",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ERRORPAGEPROFILE",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ERRORPAGEBODY",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ALERTCONFIG",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ACTIONGROUPCONFIG",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ALERTSYSLOGCONFIG",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ALERTEMAILCONFIG",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_SNMPTRAPPROFILE",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_TRAFFIC_CAPTURE",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_USER",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ROLE",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_TENANT",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_SYSTEMCONFIGURATION",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_CONTROLLER",
"type": "READ_ACCESS"
},
{
"resource": "PERMISSION_REBOOT",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_UPGRADE",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_TECHSUPPORT",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_INTERNAL",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_CONTROLLERSITE",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_USER_CREDENTIAL",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_ALERT",
"type": "NO_ACCESS"
},
{
"resource": "PERMISSION_IMAGE",
"type": "NO_ACCESS"
}
]
}
Loading