Team Access

Group Access

1. Burnham Team, only having access to resources in their dedicated namespace along with a demonstration of how we can use Kubernative native construct to ensure that only people used in team-burnham namespace can access those resources. This is also known as soft multi-tenancy you are using Kubernetes constructs like namespaces, quotas, and network policies to prevent applications from being accessed. implementations in different namespaces communicate with each other.

kubectl describe role -n team-burnham

You can see that Team Burnham can only get and list a set of application-focused Kubernetes resources (pods, daemonsets, deployments, replicasets, statefulsets, and jobs). You’ll notice that they don’t have permission to create or delete resources in their respective namespaces.

2. Retrieve the created role for Team burnham by running the following command:

aws cloudformation describe-stacks --stack-name dev-dev-blueprint | jq -r '.Stacks[0].Outputs[] | select(.OutputKey|match("burnhamteamrole"))| .OutputValue'

3. Create credentials for application

aws iam create-login-profile --user-name application --password Ekscdkworkshop123!

4. Go to AWS

   • Perform login with IAM user
   • Enter your Account ID
   • Select Next

5. Next,

   • Enter IAM user name as application
   • Enter password just created
   • Select Sign in

6. Complete the login

7. In the AWS interface

   • Select Switch role

8. In the Switch Role interface

   • Account, enter your Account ID
   • Then enter Role
   • Select Switch Role

9. Complete Switch Role

10. Access to EKS

11. Here you will see an error message stating that the Team Burnham user is NOT allowed to list deployments in all namespaces.

12. When you select team-burnham in namespace, you will see the forbidden message disappear. This means that you are currently showing Team Burnham workloads (no workloads since any workloads have not been deployed).