4

This is actually pretty well described in the docs. Before you create worker nodes, you must create an IAM role with the following IAM policies: AmazonEKSWorkerNodePolicy AmazonEKS_CNI_Policy AmazonEC2ContainerRegistryReadOnly Also you need to make sure that this role could be assumed by EKS. { "Version": "2012-10-17", "...


3

Thanks to arghya-sadhu's comments on stackoverflow, I've got it working: apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: get-pod-and-node labels: rbac.authorization.k8s.io/aggregate-to-view: "true" rules: - apiGroups: ["metrics.k8s.io"] resources: ["pods", "nodes"] verbs: ["get", "watch", "list"] (I'm aggregating to ...


2

Most CI/CD tooling will support permissions of some sort. For example: All of AWS CI/CD tooling supports limiting permissions via IAM. IAM also ties into AD which would give you that SSO (single sign on) feel. Virtually every major cloud provider will have equivalent permission based functionality (e.g. Azure, Google Cloud). Bamboo supports limiting who ...


2

My general experience is that CI/CD tools don't support impersonation or claims based authentication well or at-all. In addition you probably want the CI/CD tool to have more access than your users, because you want them to only use the CI/CD tool to change things. The way I have handled this in the past, however, was as follows: Have the pipeline call ...


2

For now there is no support for accessing Azure Table Storage with Managed Identities. Supported services are described here: Services that support managed identities for Azure resources According to documentation, Azure Table Storage allows you to authenticate only by using account key. So SAS authentication is not solution here either. Possible ...


1

Based on your title, no. It's impossible to quantify if every application has this capability. Many do. Users/Groups in Jenkins OSS map back to LDAP but you control the permissions via Jenkins. As you can see above Users/Groups have specific permissions that are specified/controlled in Jenkins. If this group exists in LDAP (xxx) the users in this group get ...


1

There are several ways to enable access, and your question touches on more than one. First method, is giving EC2 instances access to do API calls with the AWS API in another account. For this, the instances would need the appropriate IAM credentials. You can assign an IAM Role to an instance. The relationship is then "IAM Policy" -> "IAM Role" -> "IAM ...


1

To my knowledge there are only Tag based Iam policies available to limit access to resources for certain users or user groups. Because of this, you should simply be able to tag an RDS snapshot both production and development for you to access it with your development user or group. There are a large number of security considerations to think through, so ...


1

I usually stick to a 755 (or rwxr-xr-x) on my web root, but I do not think this is the issue you're running into since your directory is already set to that. nginx should have access to your directory. The question then becomes the permissions (or existence of) the file you're trying to access. The files within your directory will need to be readable by ...


1

According to the Nginx docs you can configure the user which runs Nginx. By default the user is nobody. You can read this Ask Ubuntu question that explains how to configure Apache2 to run as a different user. The default user running Apache2 is www-data. A common strategy, and one I think may work for your goal, is to assign the users that need to deploy ...


1

Hi and welcome to DevOps SE! To enable Role-Based Access Control (RBAC) for Docker Engine, you need the UCP (Universal Control Pane) available through Docker EE. https://success.docker.com/article/rbac-example-overview A free alternative could be also the Kubernetes module rbac.authorization.k8s.io. Side note: To control docker commands available to a ...


Only top voted, non community-wiki answers of a minimum length are eligible