numberly/gitlab2rbac repository overview

⁠gitlab2rbac

This is a beta version. gitlab2rbac is still undergoing final testing before its official release.

gitlab2rbac ensures that your Kubernetes cluster users have the same permissions than on GitLab.

It takes GitLab Permissions⁠ by project as input and generates RBAC⁠ objects inside Kubernetes.

⁠Installation

⁠Requirements

Before anything else, gitlab2rbac requires:

• RBAC enabled on your Kubernetes cluster⁠
• GitLab API with v4 support⁠

⁠Configuration

gitlab2rbac needs a namespace, cluster roles and cluster role bindings. Create them with:

$ kubectl apply -f https://raw.githubusercontent.com/numberly/gitlab2rbac/master/deploy/configuration.yaml

You will then need to create a ConfigMap⁠ that contains all the useful information for gitlab2rbac:

cat <<EOF | kubectl create -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitlab2rbac
  namespace: gitlab2rbac
data:
  GITLAB_URL: https://{{ your GitLab instance URL }}
  GITLAB_PRIVATE_TOKEN: {{ your GitLab private token }}
  KUBERNETES_LOAD_INCLUSTER_CONFIG: "True"
EOF

⁠Deployment

Finally, just apply the manifest:

$ kubectl apply -f https://raw.githubusercontent.com/numberly/gitlab2rbac/master/deploy/gitlab2rbac.yaml

This will deploy gitlab2rbac to your cluster, under the gitlab2rbac namespace. The components in the manifest are:

• the deployment, which is the cluster-wide controller that handles RBAC policies
• the service account and the RBAC permissions that the controller need to function

⁠Running locally

⁠Requirements

• Python 3 (should also work with Python 2 but it's not supported)
• Virtualenv (recommended)

⁠Setup

Even if gitlab2rbac doesn't run inside Kubernetes, it needs a cluster with existing cluster roles. Create them with:

$ kubectl apply -f https://raw.githubusercontent.com/numberly/gitlab2rbac/master/deploy/configuration.yaml

Then you can clone the repository, install the dependencies and run gitlab2rbac:

$ git clone https://github.com/numberly/gitlab2rbac.git
$ cd gitlab2rbac
$ virtualenv .venv && source .venv/bin/activate
(.venv) $ pip install -r requirements.txt
(.venv) $ GITLAB_URL={{ your GitLab instance URL }} GITLAB_PRIVATE_TOKEN={{ your GitLab private token }} python gitlab2rbac.py

⁠Default configuration

⁠Roles description

⁠RBAC grid

What we mean by R and W is defined by Kubernetes API verbs:

• Read (R): get, list, watch
• Write (W): create, update, patch, delete, deletecollection

⁠Cluster-wide

Any authenticated user has access to those cluster-wide resources:

• apiservices
• componentstatuses
• namespaces
• nodes

Any admin on GitLab is an admin of the Kubernetes cluster.

⁠Workload

⁠Actions

⁠Setup

⁠Advanced configuration

gitlab2rbac supports multiple environment variables for advanced configuration:

⁠License

MIT