mirror of
https://github.com/siderolabs/talos.git
synced 2025-09-11 00:41:13 +02:00
d6309eed66
Docs generation switched to v0.14 folder. Signed-off-by: Andrey Smirnov <andrey.smirnov@talos-systems.com>
49 lines
1.6 KiB
Markdown
49 lines
1.6 KiB
Markdown
---
|
|
title: Role-based access control (RBAC)
|
|
---
|
|
|
|
Talos v0.11 introduced initial support for role-based access control (RBAC).
|
|
This guide will explain what that is and how to enable it without losing access to the cluster.
|
|
|
|
## RBAC in Talos
|
|
|
|
Talos uses certificates to authorize users.
|
|
The certificate subject's organization field is used to encode user roles.
|
|
There is a set of predefined roles that allow access to different [API methods](../../reference/api/):
|
|
|
|
* `os:admin` grants access to all methods;
|
|
* `os:reader` grants access to "safe" methods (for example, that includes the ability to list files, but does not include the ability to read files content);
|
|
* `os:etcd:backup` grants access to [`/machine.MachineService/EtcdSnapshot`](../../reference/api/#machine.EtcdSnapshotRequest) method.
|
|
|
|
Roles in the current `talosconfig` can be checked with the following command:
|
|
|
|
```sh
|
|
$ talosctl config info
|
|
|
|
[...]
|
|
Roles: os:admin
|
|
[...]
|
|
```
|
|
|
|
RBAC is enabled by default in new clusters created with `talosctl` v0.11+ and disabled otherwise.
|
|
|
|
## Enabling RBAC
|
|
|
|
First, both the Talos cluster and `talosctl` tool should be [upgraded](../upgrading-talos/).
|
|
Then the `talosctl config new` command should be used to generate a new client configuration with the `os:admin` role.
|
|
Additional configurations and certificates for different roles can be generated by passing `--roles` flag:
|
|
|
|
```sh
|
|
talosctl config new --roles=os:reader reader
|
|
```
|
|
|
|
That command will create a new client configuration file `reader` with a new certificate with `os:reader` role.
|
|
|
|
After that, RBAC should be enabled in the machine configuration:
|
|
|
|
```yaml
|
|
machine:
|
|
features:
|
|
rbac: true
|
|
```
|