{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/dashboard/issues/1014","repository_url":"https://api.github.com/repos/kubernetes/dashboard","labels_url":"https://api.github.com/repos/kubernetes/dashboard/issues/1014/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/dashboard/issues/1014/comments","events_url":"https://api.github.com/repos/kubernetes/dashboard/issues/1014/events","html_url":"https://github.com/kubernetes/dashboard/issues/1014","id":165079065,"number":1014,"title":"Dashboard authentication and authorization","user":{"login":"kanor1306","id":1013912,"avatar_url":"https://avatars.githubusercontent.com/u/1013912?v=3","gravatar_id":"","url":"https://api.github.com/users/kanor1306","html_url":"https://github.com/kanor1306","followers_url":"https://api.github.com/users/kanor1306/followers","following_url":"https://api.github.com/users/kanor1306/following{/other_user}","gists_url":"https://api.github.com/users/kanor1306/gists{/gist_id}","starred_url":"https://api.github.com/users/kanor1306/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kanor1306/subscriptions","organizations_url":"https://api.github.com/users/kanor1306/orgs","repos_url":"https://api.github.com/users/kanor1306/repos","events_url":"https://api.github.com/users/kanor1306/events{/privacy}","received_events_url":"https://api.github.com/users/kanor1306/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-07-12T13:22:33Z","updated_at":"2016-07-14T17:59:29Z","closed_at":null,"body":"#### Issue details\r\nI have two dashboards, one is the admin-dashboard, deployed using the `kube-system:default` service account, that should be able to do all operations within any namespace. Then, I have another dashboard, the developer one, that should only be able to see the things in the `kube-system` namespace, but not delete or create.  In other namespaces, it should be able to create and delete. This dashboard is deployed using another service account, `kube-system:dashboard-dev` that has readonly permissions in `kube-system`.\r\n\r\nThis two dashboards are running correctly and working as expected, but I also want to control what users can access to each of the dashboards (using, for now, basic auth). For testing purposes I have two users, admin, and developer.  The authorization policy of admin is that he is allowed to get into everything, and the one of the developer is that he is only allowed to use the developer dashboard\r\n\r\nThe idea of this approach is to have two users, one admin and one developer. The admin can do whatever he wants using kubectl or using the admin dashboard. The developer should be able to do everything with kubectl only in the default namespace, and reading in the kube-system. The developer should also be able to access the developer dashboard.\r\n\r\n##### Environment\r\n* Authorization-mode=ABAC\r\n* Using basic authentication: two users, admin and developer\r\n\r\n```\r\nDashboard version: 1.1.0\r\nKubernetes version: 1.2.4\r\nOperating system: CentOS 7\r\n```\r\n\r\n##### Steps to reproduce\r\n* Deploy a dashboard using an specific service account, i.e. dashboard-dev  \r\nThe authorization policy of that service account is: \r\n`{\"apiVersion\": \"abac.authorization.kubernetes.io/v1beta1\", \"kind\": \"Policy\", \"spec\": {\"user\":\"system:serviceaccount:kube-system:dashboard-dev\",\"namespace\": \"kube-system\", \"resource\": \"*\", \"apiGroup\":\"*\", \"nonResourcePath\": \"*\", \"readonly\": true}}`  \r\n`{\"apiVersion\": \"abac.authorization.kubernetes.io/v1beta1\", \"kind\": \"Policy\", \"spec\": {\"user\":\"system:serviceaccount:kube-system:dashboard-dev\",\"namespace\": \"default\", \"resource\": \"*\", \"apiGroup\":\"*\", \"nonResourcePath\": \"*\"}}`\r\n* Access to the dashboard using a user with limited permissions, i.e. developer, with the following authorization policy: \r\n`{\"apiVersion\": \"abac.authorization.kubernetes.io/v1beta1\", \"kind\": \"Policy\", \"spec\": {\"user\":\"developer\",\"namespace\": \"kube-system\", \"resource\": \"*\", \"apiGroup\":\"*\", \"nonResourcePath\": \"*\", \"readonly\":true}}`  \r\n`{\"apiVersion\": \"abac.authorization.kubernetes.io/v1beta1\", \"kind\": \"Policy\", \"spec\": {\"user\":\"developer\",\"namespace\": \"default\", \"resource\": \"*\", \"apiGroup\":\"*\", \"nonResourcePath\": \"*\"}}`\r\n\r\n\r\n##### Observed result\r\n* You can access to the dashboard login in the authentication prompt with the admin user. The dashboard works as expected. This is, it cannot delete or create anything inside kube-system, but it can do it in default namespace.\r\n* **You cannot access to the dashboard using the developer user.** The browser shows this plain text message:  `Forbidden: \"/api/v1/proxy/namespaces/kube-system/services/kubernetes-dashboard\"`\r\n\r\n##### Expected result\r\n* **Developer user can access to the dashboard.**\r\n\r\nAny insight or explanation about why this is happening? or maybe if it is even possible to achieve this?\r\n\r\nThanks in advance!\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/dashboard/issues/comments/232743054","html_url":"https://github.com/kubernetes/dashboard/issues/1014#issuecomment-232743054","issue_url":"https://api.github.com/repos/kubernetes/dashboard/issues/1014","id":232743054,"user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"created_at":"2016-07-14T17:59:29Z","updated_at":"2016-07-14T17:59:29Z","body":"As for the imagereference stuff, I don't know how dashboard decides who is authorized to do `api/v1/appdeployment/validate/imagereference`.\r\n"}}
{"actor":{"display_login":"erictune"}}