Gloo permissions

Review the default Kubernetes role-based access control (RBAC) permissions of Gloo and Gloo-deployed components.

When you install a Gloo product, you deploy several core and addon components, such as the management server, agent, and external auth service. For more information about the components, see Platform architecture.

These components might come with a default set of permissions granted by Kubernetes RBAC cluster roles and roles. Some components that do not need Kubernetes permissions, such as Redis or Clickhouse databases, do not have Kubernetes RBAC resources. Other components, such as the management server, agent, and UI, might have several cluster roles that are used to scope certain permissions on sensitive resources such as secrets to namespaces.

Check the RBAC setup

In Kubernetes RBAC, roles and cluster roles configure a set of permissions, such as to view or modify Kubernetes objects. Role bindings and cluster role bindings bind these permissions to a subject in Kubernetes, such as a service account. For more information, see the Kubernetes docs. Most Gloo components have their own Kubernetes service accounts, roles or cluster roles, and role bindings or cluster role bindings.

To check the RBAC setup for each component, you can run the following commands. Alternatively, you can check the permissions tables for each component in Review Gloo permissions.

1. Get the Kubernetes RBAC resources for the Gloo component that you want to check.

   • Management server
   • Agent
   • UI
   • Prometheus
   • Ext auth
   • Rate limiter
   • Portal
   • OTel
   • Operator
   • Istio
   • Gateway

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app=gloo-mesh-mgmt-server
   

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app=gloo-mesh-agent
   

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app=gloo-mesh-ui
   

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app=prometheus
   

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app=ext-auth-service
   

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app=rate-limiter
   

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app=gloo-mesh-portal-server
   

   For optional components that are installed by Gloo Gateway via Helm, such as the OpenTelemetry (OTel) gateways and collectors.

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l app.kubernetes.io/instance=gloo-platform
   

   For the Istio operator used by Gloo's Istio Lifeycle Manager.

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l gloo.solo.io/parent_name=gloo-platform
   

   For instances installed by Gloo's Istio Lifecycle Manager, such as istiod and the Istio gateway controller.

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l install.operator.istio.io/owning-resource=gloo-platform
   

   For the Istio ingress gateway.

   kubectl get clusterroles,clusterrolebindings,roles,rolebindings,serviceaccounts -A -l install.operator.istio.io/owning-resource=istio-ingressgateway-1-18-2
   

2. Check the role binding or cluster role binding for the component. Make sure that the role or cluster role in the Role section and the service account in the Subjects section match the names for the Gloo component in the output from the previous step.

   kubectl describe clusterrolebinding gloo-mesh-mgmt-server-gloo-platform
   

   Example output: The cluster role binding grants the gloo-mesh-mgmt-server service account access in the gloo-mesh namespace the gloo-mesh-mgmt-server-gloo-platform cluster role.

   Role:
       Kind:  ClusterRole
       Name:  gloo-mesh-mgmt-server-gloo-platform
   Subjects:
       Kind            Name                   Namespace
       ----            ----                   ---------
       ServiceAccount  gloo-mesh-mgmt-server  gloo-mesh
   

3. Get the details of a cluster role or role. Check the PolicyRule in each role or cluster role to review specific permissions.

   The following example shows how the management server can have both roles and cluster roles if you restrict its permissions. Some other Gloo components might have only roles or cluster roles, depending on your setup.
   • Role
   • Cluster role

   kubectl describe role -n gloo-mesh gloo-mesh-mgmt-server-gloo-platform-gloo-mesh-namespaced
   kubectl describe role -n gloo-mesh-addons gloo-mesh-mgmt-server-gloo-platform-gloo-mesh-namespaced
   

   Example output: The roles grant the Gloo management server access to Kubernetes secrets. Because the roles that you described are scoped to the gloo-mesh and gloo-mesh-addons namespaces, the management server can access secrets in the those namespaces only.

   PolicyRule:
     Resources       Non-Resource URLs  Resource Names  Verbs
     ---------       -----------------  --------------  -----
     secrets         []                 []              [*]
     secrets/status  []                 []              [get, update]
   

   kubectl describe clusterrole gloo-mesh-mgmt-server-gloo-platform
   

   Example output: The default Kubernetes RBAC for the management server normally includes access to secrets. However, in this example, you restricted access to only the gloo-mesh and gloo-mesh-addon namespaces through roles and role bindings. Therefore, the cluster role no longer has access to secrets.

   PolicyRule:
     Resources                                                                 Non-Resource URLs  Resource Names  Verbs
     ---------                                                                 -----------------  --------------  -----
     configmaps                                                                []                 []              [*]
     namespaces                                                                []                 []              [*]
     pods                                                                      []                 []              [*]
     serviceaccounts                                                           []                 []              [*]
     services                                                                  []                 []              [*]
     mutatingwebhookconfigurations.admissionregistration.k8s.io                []                 []              [*]
     validatingwebhookconfigurations.admissionregistration.k8s.io              []                 []              [*]
     apidocs.apimanagement.gloo.solo.io                                        []                 []              [*]
     deployments.apps                                                          []                 []              [*]
     ciliumnetworkpolicies.cilium.io                                           []                 []              [*]
     leases.coordination.k8s.io                                                []                 []              [*]
     authconfigs.extauth.solo.io                                               []                 []              [*]
     gateways.gateway.networking.k8s.io                                        []                 []              [*]
     cloudresources.infrastructure.gloo.solo.io                                []                 []              [*]
     istiooperators.install.istio.io                                           []                 []              [*]
     issuedcertificates.internal.gloo.solo.io                                  []                 []              [*]
     portalconfigs.internal.gloo.solo.io                                       []                 []              [*]
     spireregistrationentries.internal.gloo.solo.io                            []                 []              [*]
     xdsconfigs.internal.gloo.solo.io                                          []                 []              [*]
     destinationrules.networking.istio.io                                      []                 []              [*]
     envoyfilters.networking.istio.io                                          []                 []              [*]
     gateways.networking.istio.io                                              []                 []              [*]
     serviceentries.networking.istio.io                                        []                 []              [*]
     sidecars.networking.istio.io                                              []                 []              [*]
     virtualservices.networking.istio.io                                       []                 []              [*]
     workloadentries.networking.istio.io                                       []                 []              [*]
     workloadgroups.networking.istio.io                                        []                 []              [*]
     networkpolicies.networking.k8s.io                                         []                 []              [*]
     ratelimitconfigs.ratelimit.solo.io                                        []                 []              [*]
     clusterrolebindings.rbac.authorization.k8s.io                             []                 []              [*]
     clusterroles.rbac.authorization.k8s.io                                    []                 []              [*]
     authorizationpolicies.security.istio.io                                   []                 []              [*]
     peerauthentications.security.istio.io                                     []                 []              [*]
     nodes                                                                     []                 []              [get list watch]
     dashboards.admin.gloo.solo.io                                             []                 []              [get list watch]
     extauthservers.admin.gloo.solo.io                                         []                 []              [get list watch]
     gatewaylifecyclemanagers.admin.gloo.solo.io                               []                 []              [get list watch]
     istiolifecyclemanagers.admin.gloo.solo.io                                 []                 []              [get list watch]
     kubernetesclusters.admin.gloo.solo.io                                     []                 []              [get list watch]
     ratelimitserverconfigs.admin.gloo.solo.io                                 []                 []              [get list watch]
     ratelimitserversettings.admin.gloo.solo.io                                []                 []              [get list watch]
     roottrustpolicies.admin.gloo.solo.io                                      []                 []              [get list watch]
     waypointlifecyclemanagers.admin.gloo.solo.io                              []                 []              [get list watch]
     workspaces.admin.gloo.solo.io                                             []                 []              [get list watch]
     workspacesettings.admin.gloo.solo.io                                      []                 []              [get list watch]
     customresourcedefinitions.apiextensions.k8s.io                            []                 []              [get list watch]
     apischemadiscoveries.apimanagement.gloo.solo.io                           []                 []              [get list watch]
     graphqlresolvermaps.apimanagement.gloo.solo.io                            []                 []              [get list watch]
     graphqlschemas.apimanagement.gloo.solo.io                                 []                 []              [get list watch]
     graphqlstitchedschemas.apimanagement.gloo.solo.io                         []                 []              [get list watch]
     portalgroups.apimanagement.gloo.solo.io                                   []                 []              [get list watch]
     portals.apimanagement.gloo.solo.io                                        []                 []              [get list watch]
     daemonsets.apps                                                           []                 []              [get list watch]
     statefulsets.apps                                                         []                 []              [get list watch]
     wasmdeploymentpolicies.extensions.policy.gloo.solo.io                     []                 []              [get list watch]
     gatewayclasses.gateway.networking.k8s.io                                  []                 []              [get list watch]
     grpcroutes.gateway.networking.k8s.io                                      []                 []              [get list watch]
     httproutes.gateway.networking.k8s.io                                      []                 []              [get list watch]
     referencegrants.gateway.networking.k8s.io                                 []                 []              [get list watch]
     tcproutes.gateway.networking.k8s.io                                       []                 []              [get list watch]
     tlsroutes.gateway.networking.k8s.io                                       []                 []              [get list watch]
     udproutes.gateway.networking.k8s.io                                       []                 []              [get list watch]
     cloudproviders.infrastructure.gloo.solo.io                                []                 []              [get list watch]
     certificaterequests.internal.gloo.solo.io                                 []                 []              [get list watch]
     discoveredcnis.internal.gloo.solo.io                                      []                 []              [get list watch]
     discoveredgateways.internal.gloo.solo.io                                  []                 []              [get list watch]
     meshes.internal.gloo.solo.io                                              []                 []              [get list watch]
     externalendpoints.networking.gloo.solo.io                                 []                 []              [get list watch]
     externalservices.networking.gloo.solo.io                                  []                 []              [get list watch]
     externalworkloads.networking.gloo.solo.io                                 []                 []              [get list watch]
     routetables.networking.gloo.solo.io                                       []                 []              [get list watch]
     virtualdestinations.networking.gloo.solo.io                               []                 []              [get list watch]
     virtualgateways.networking.gloo.solo.io                                   []                 []              [get list watch]
     accesslogpolicies.observability.policy.gloo.solo.io                       []                 []              [get list watch]
     rolebindings.rbac.authorization.k8s.io                                    []                 []              [get list watch]
     roles.rbac.authorization.k8s.io                                           []                 []              [get list watch]
     activehealthcheckpolicies.resilience.policy.gloo.solo.io                  []                 []              [get list watch]
     connectionpolicies.resilience.policy.gloo.solo.io                         []                 []              [get list watch]
     failoverpolicies.resilience.policy.gloo.solo.io                           []                 []              [get list watch]
     faultinjectionpolicies.resilience.policy.gloo.solo.io                     []                 []              [get list watch]
     graphqlpersistedquerycachepolicies.resilience.policy.gloo.solo.io         []                 []              [get list watch]
     listenerconnectionpolicies.resilience.policy.gloo.solo.io                 []                 []              [get list watch]
     outlierdetectionpolicies.resilience.policy.gloo.solo.io                   []                 []              [get list watch]
     retrytimeoutpolicies.resilience.policy.gloo.solo.io                       []                 []              [get list watch]
     trimproxyconfigpolicies.resilience.policy.gloo.solo.io                    []                 []              [get list watch]
     accesspolicies.security.policy.gloo.solo.io                               []                 []              [get list watch]
     clienttlspolicies.security.policy.gloo.solo.io                            []                 []              [get list watch]
     corspolicies.security.policy.gloo.solo.io                                 []                 []              [get list watch]
     csrfpolicies.security.policy.gloo.solo.io                                 []                 []              [get list watch]
     dlppolicies.security.policy.gloo.solo.io                                  []                 []              [get list watch]
     extauthpolicies.security.policy.gloo.solo.io                              []                 []              [get list watch]
     graphqlallowedquerypolicies.security.policy.gloo.solo.io                  []                 []              [get list watch]
     jwtpolicies.security.policy.gloo.solo.io                                  []                 []              [get list watch]
     wafpolicies.security.policy.gloo.solo.io                                  []                 []              [get list watch]
     headermanipulationpolicies.trafficcontrol.policy.gloo.solo.io             []                 []              [get list watch]
     httpbufferpolicies.trafficcontrol.policy.gloo.solo.io                     []                 []              [get list watch]
     loadbalancerpolicies.trafficcontrol.policy.gloo.solo.io                   []                 []              [get list watch]
     mirrorpolicies.trafficcontrol.policy.gloo.solo.io                         []                 []              [get list watch]
     proxyprotocolpolicies.trafficcontrol.policy.gloo.solo.io                  []                 []              [get list watch]
     ratelimitclientconfigs.trafficcontrol.policy.gloo.solo.io                 []                 []              [get list watch]
     ratelimitpolicies.trafficcontrol.policy.gloo.solo.io                      []                 []              [get list watch]
     transformationpolicies.trafficcontrol.policy.gloo.solo.io                 []                 []              [get list watch]
     namespaces/status                                                         []                 []              [get update]
     nodes/status                                                              []                 []              [get update]
     serviceaccounts/status                                                    []                 []              [get update]
     services/status                                                           []                 []              [get update]
     dashboards.admin.gloo.solo.io/status                                      []                 []              [get update]
     extauthservers.admin.gloo.solo.io/status                                  []                 []              [get update]
     gatewaylifecyclemanagers.admin.gloo.solo.io/status                        []                 []              [get update]
     istiolifecyclemanagers.admin.gloo.solo.io/status                          []                 []              [get update]
     kubernetesclusters.admin.gloo.solo.io/status                              []                 []              [get update]
     ratelimitserverconfigs.admin.gloo.solo.io/status                          []                 []              [get update]
     ratelimitserversettings.admin.gloo.solo.io/status                         []                 []              [get update]
     roottrustpolicies.admin.gloo.solo.io/status                               []                 []              [get update]
     waypointlifecyclemanagers.admin.gloo.solo.io/status                       []                 []              [get update]
     workspaces.admin.gloo.solo.io/status                                      []                 []              [get update]
     workspacesettings.admin.gloo.solo.io/status                               []                 []              [get update]
     apidocs.apimanagement.gloo.solo.io/status                                 []                 []              [get update]
     apischemadiscoveries.apimanagement.gloo.solo.io/status                    []                 []              [get update]
     graphqlresolvermaps.apimanagement.gloo.solo.io/status                     []                 []              [get update]
     graphqlschemas.apimanagement.gloo.solo.io/status                          []                 []              [get update]
     graphqlstitchedschemas.apimanagement.gloo.solo.io/status                  []                 []              [get update]
     portalgroups.apimanagement.gloo.solo.io/status                            []                 []              [get update]
     portals.apimanagement.gloo.solo.io/status                                 []                 []              [get update]
     daemonsets.apps/status                                                    []                 []              [get update]
     deployments.apps/status                                                   []                 []              [get update]
     statefulsets.apps/status                                                  []                 []              [get update]
     ciliumnetworkpolicies.cilium.io/status                                    []                 []              [get update]
     authconfigs.extauth.solo.io/status                                        []                 []              [get update]
     wasmdeploymentpolicies.extensions.policy.gloo.solo.io/status              []                 []              [get update]
     gatewayclasses.gateway.networking.k8s.io/status                           []                 []              [get update]
     gateways.gateway.networking.k8s.io/status                                 []                 []              [get update]
     grpcroutes.gateway.networking.k8s.io/status                               []                 []              [get update]
     httproutes.gateway.networking.k8s.io/status                               []                 []              [get update]
     referencegrants.gateway.networking.k8s.io/status                          []                 []              [get update]
     tcproutes.gateway.networking.k8s.io/status                                []                 []              [get update]
     tlsroutes.gateway.networking.k8s.io/status                                []                 []              [get update]
     udproutes.gateway.networking.k8s.io/status                                []                 []              [get update]
     cloudproviders.infrastructure.gloo.solo.io/status                         []                 []              [get update]
     cloudresources.infrastructure.gloo.solo.io/status                         []                 []              [get update]
     istiooperators.install.istio.io/status                                    []                 []              [get update]
     certificaterequests.internal.gloo.solo.io/status                          []                 []              [get update]
     discoveredcnis.internal.gloo.solo.io/status                               []                 []              [get update]
     discoveredgateways.internal.gloo.solo.io/status                           []                 []              [get update]
     issuedcertificates.internal.gloo.solo.io/status                           []                 []              [get update]
     meshes.internal.gloo.solo.io/status                                       []                 []              [get update]
     portalconfigs.internal.gloo.solo.io/status                                []                 []              [get update]
     spireregistrationentries.internal.gloo.solo.io/status                     []                 []              [get update]
     externalendpoints.networking.gloo.solo.io/status                          []                 []              [get update]
     externalservices.networking.gloo.solo.io/status                           []                 []              [get update]
     externalworkloads.networking.gloo.solo.io/status                          []                 []              [get update]
     routetables.networking.gloo.solo.io/status                                []                 []              [get update]
     virtualdestinations.networking.gloo.solo.io/status                        []                 []              [get update]
     virtualgateways.networking.gloo.solo.io/status                            []                 []              [get update]
     destinationrules.networking.istio.io/status                               []                 []              [get update]
     envoyfilters.networking.istio.io/status                                   []                 []              [get update]
     gateways.networking.istio.io/status                                       []                 []              [get update]
     serviceentries.networking.istio.io/status                                 []                 []              [get update]
     sidecars.networking.istio.io/status                                       []                 []              [get update]
     virtualservices.networking.istio.io/status                                []                 []              [get update]
     workloadentries.networking.istio.io/status                                []                 []              [get update]
     accesslogpolicies.observability.policy.gloo.solo.io/status                []                 []              [get update]
     ratelimitconfigs.ratelimit.solo.io/status                                 []                 []              [get update]
     clusterrolebindings.rbac.authorization.k8s.io/status                      []                 []              [get update]
     clusterroles.rbac.authorization.k8s.io/status                             []                 []              [get update]
     rolebindings.rbac.authorization.k8s.io/status                             []                 []              [get update]
     roles.rbac.authorization.k8s.io/status                                    []                 []              [get update]
     activehealthcheckpolicies.resilience.policy.gloo.solo.io/status           []                 []              [get update]
     connectionpolicies.resilience.policy.gloo.solo.io/status                  []                 []              [get update]
     failoverpolicies.resilience.policy.gloo.solo.io/status                    []                 []              [get update]
     faultinjectionpolicies.resilience.policy.gloo.solo.io/status              []                 []              [get update]
     graphqlpersistedquerycachepolicies.resilience.policy.gloo.solo.io/status  []                 []              [get update]
     listenerconnectionpolicies.resilience.policy.gloo.solo.io/status          []                 []              [get update]
     outlierdetectionpolicies.resilience.policy.gloo.solo.io/status            []                 []              [get update]
     retrytimeoutpolicies.resilience.policy.gloo.solo.io/status                []                 []              [get update]
     trimproxyconfigpolicies.resilience.policy.gloo.solo.io/status             []                 []              [get update]
     authorizationpolicies.security.istio.io/status                            []                 []              [get update]
     peerauthentications.security.istio.io/status                              []                 []              [get update]
     accesspolicies.security.policy.gloo.solo.io/status                        []                 []              [get update]
     clienttlspolicies.security.policy.gloo.solo.io/status                     []                 []              [get update]
     corspolicies.security.policy.gloo.solo.io/status                          []                 []              [get update]
     csrfpolicies.security.policy.gloo.solo.io/status                          []                 []              [get update]
     dlppolicies.security.policy.gloo.solo.io/status                           []                 []              [get update]
     extauthpolicies.security.policy.gloo.solo.io/status                       []                 []              [get update]
     graphqlallowedquerypolicies.security.policy.gloo.solo.io/status           []                 []              [get update]
     jwtpolicies.security.policy.gloo.solo.io/status                           []                 []              [get update]
     wafpolicies.security.policy.gloo.solo.io/status                           []                 []              [get update]
     headermanipulationpolicies.trafficcontrol.policy.gloo.solo.io/status      []                 []              [get update]
     httpbufferpolicies.trafficcontrol.policy.gloo.solo.io/status              []                 []              [get update]
     loadbalancerpolicies.trafficcontrol.policy.gloo.solo.io/status            []                 []              [get update]
     mirrorpolicies.trafficcontrol.policy.gloo.solo.io/status                  []                 []              [get update]
     proxyprotocolpolicies.trafficcontrol.policy.gloo.solo.io/status           []                 []              [get update]
     ratelimitclientconfigs.trafficcontrol.policy.gloo.solo.io/status          []                 []              [get update]
     ratelimitpolicies.trafficcontrol.policy.gloo.solo.io/status               []                 []              [get update]
     transformationpolicies.trafficcontrol.policy.gloo.solo.io/status          []                 []              [get update]
   

4. Repeat the previous step for each component that you want to check. The following commands check all roles and cluster roles per component and pipe the output to jq to get only the PolicyRules. Alternatively, you can check the permissions tables for each component in Review Gloo permissions.

   • Management server
   • Agent
   • UI
   • Prometheus
   • Ext auth
   • Rate limiter
   • Portal
   • OTel
   • Operator
   • Istio
   • Gateway

   kubectl get clusterrole,role -l app=gloo-mesh-mgmt-server -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   kubectl get clusterrole,role -l app=gloo-mesh-agent -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   kubectl get clusterrole,role -l app=gloo-mesh-ui -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   kubectl get clusterrole,role -l app=prometheus -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   kubectl get clusterrole,role -l app=ext-auth-service -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   kubectl get clusterrole,role -l app=rate-limiter -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   kubectl get clusterrole,role -l app=gloo-mesh-portal-server -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   For optional components that are installed by Gloo Platform via Helm, such as OpenTelemetry (OTel) gateways and collectors.

   kubectl get clusterrole,role -l app.kubernetes.io/instance=gloo-platform -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   For the Istio operator used by Gloo's Istio Lifeycle Manager.

   kubectl get clusterrole,role -l gloo.solo.io/parent_name=gloo-platform -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   For components that are installed by the Gloo Istio Lifecycle Manager, such as istiod and the Istio gateway controller.

   kubectl get clusterrole,role -l install.operator.istio.io/owning-resource=gloo-platform -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   kubectl get clusterrole,role -l operator.istio.io/component=IngressGateways -A -o json | jq -r '.items[] | {Name: .metadata.name, PolicyRules: .rules} | select(.PolicyRules != null)'
   

   Example output:

   {
     "Name": "istio-ingressgateway-1-18-2-sds",
     "PolicyRules": [
       {
         "apiGroups": [
           ""
         ],
         "resources": [
           "secrets"
         ],
         "verbs": [
           "get",
           "watch",
           "list"
         ]
       }
     ]
   }
   

Review Gloo permissions

Review the following tables that describe the default permissions by Gloo component. For steps to check these permissions in your cluster setup, see Check default RBAC setup. For steps to modify these permission, see Restrict default permissions.

Restrict default permissions

You can restrict the permissions for select Gloo components. By default, Gloo components use Kubernetes cluster roles and cluster role bindings to get access to resources on a cluster-wide level. To restrict these permissions, configure the namespacedRbac Helm option for select Gloo components during your Gloo installation or upgrade.

• Default behavior without namespacedRbac: Gloo creates separate cluster roles and cluster role bindings per component for the resources that can and cannot be restricted to namespaces. For resources that can be restricted by namespace, the cluster role and cluster role bindings have *-namespaced in their name.
• With namespacedRbac: Gloo creates roles and role bindings per component for the restricted resources in the selected namespaces, such as gloo-mesh. These roles and role bindings have *-namespaced in their name, such as gloo-mesh-mgmt-server-gloo-platform-gloo-mesh-namespaced. Gloo still creates a cluster role and cluster role binding per component for all the other resources that the component needs access to.

Gloo components that you can restrict access for:

• Gloo management server
• Gloo agent
• Gloo UI
• External auth service

Resources that you can restrict access to:

• Kubernetes secrets

At a minimum, you must allow access to the following namespaces for each Gloo component:

• gloo-mesh, or if you used a different name, the namespace that your management server, UI, and agent are deployed to.
• gloo-mesh-addons, or if you used a different name, the namespace that your add-on components such as the external auth service, rate limiter, or developer portal are deployed to. Depending on your setup, you might have all of these Gloo components together in a single namespace, such as gloo-mesh.

1. Check the Helm releases in your cluster. Depending on your installation method, you either have only a main installation release (such as gloo-platform), or a main installation and a separate add-ons release (such as gloo-agent-addons), in addition to your CRDs release.

   helm ls -A
   

2. Get your current installation values.

   • If you have only one release for your installation, get those values. Note that if you migrated from the legacy Helm charts, your Helm release might be named gloo-mgmt or gloo-mesh-enterprise instead.

     helm get values gloo-platform -n gloo-mesh -o yaml > gloo-gateway-single.yaml
     open gloo-gateway-single.yaml
     

   • If you have a separate add-ons release, get those values.

     helm get values gloo-agent-addons -n gloo-mesh-addons -o yaml > gloo-agent-addons.yaml
     open gloo-agent-addons.yaml
     

3. Add the following settings in the sections for each component that you want to restrict Kubernetes RBAC permissions to namespaces. Keep in mind the following points:

   • You can restrict only Kubernetes secrets.
   • You must include the namespaces that the Gloo components are deployed to, such as gloo-mesh and gloo-mesh-addons. If your namespaces have different names, replace these values.
   • You add these values along with all the rest of the values in your Helm configuration file.
   • Management server
   • Agent
   • UI
   • Ext auth
   • Single-cluster full example

   glooMgmtServer:
     enabled: true
     namespacedRbac:
     - resources:
       - secrets
       namespaces:
       - gloo-mesh
       - gloo-mesh-addons
   ...
   

   glooAgent:
     enabled: true
     namespacedRbac:
     - resources:
       - secrets
       namespaces:
       - gloo-mesh
       - gloo-mesh-addons
   ...
   

   glooUi:
     enabled: true
     namespacedRbac:
     - resources:
       - secrets
       namespaces:
       - gloo-mesh
       - gloo-mesh-addons
   

   extAuthService:
     enabled: true
     extAuth:
       namespacedRbac:
       - resources:
         - secrets
         namespaces:
         - gloo-mesh
         - gloo-mesh-addons
   ...
   

   clickhouse:
     enabled: true
   glooAgent:
     enabled: true
     relay:
       serverAddress: gloo-mesh-mgmt-server.gloo-mesh:9900
     namespacedRbac:
     - resources:
       - secrets
       namespaces:
       - gloo-mesh
       - gloo-mesh-addons
   glooMgmtServer:
     serviceType: ClusterIP
     registerCluster: true
     enabled: true
     createGlobalWorkspace: true
     namespacedRbac:
     - resources:
       - secrets
       namespaces:
       - gloo-mesh
       - gloo-mesh-addons
   glooUi:
     enabled: true
     namespacedRbac:
     - resources:
       - secrets
       namespaces:
       - gloo-mesh
       - gloo-mesh-addons
   istioInstallations:
     controlPlane:
       enabled: true
       installations:
         - istioOperatorSpec:
             meshConfig:
               accessLogFile: /dev/stdout
               accessLogEncoding: JSON
               accessLogFormat: |
                 {
                   "timestamp": "%START_TIME%",
                   "server_name": "%REQ(:AUTHORITY)%",
                   "response_duration": "%DURATION%",
                   "request_command": "%REQ(:METHOD)%",
                   "request_uri": "%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%",
                   "request_protocol": "%PROTOCOL%",
                   "status_code": "%RESPONSE_CODE%",
                   "client_address": "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%",
                   "x_forwarded_for": "%REQ(X-FORWARDED-FOR)%",
                   "bytes_sent": "%BYTES_SENT%",
                   "bytes_received": "%BYTES_RECEIVED%",
                   "user_agent": "%REQ(USER-AGENT)%",
                   "downstream_local_address": "%DOWNSTREAM_LOCAL_ADDRESS%",
                   "requested_server_name": "%REQUESTED_SERVER_NAME%",
                   "request_id": "%REQ(X-REQUEST-ID)%",
                   "response_flags": "%RESPONSE_FLAGS%",
                   "route_name": "%ROUTE_NAME%",
                   "upstream_cluster": "%UPSTREAM_CLUSTER%",
                   "upstream_host": "%UPSTREAM_HOST%",
                   "upstream_local_address": "%UPSTREAM_LOCAL_ADDRESS%",
                   "upstream_service_time": "%REQ(x-envoy-upstream-service-time)%",
                   "upstream_transport_failure_reason": "%UPSTREAM_TRANSPORT_FAILURE_REASON%",
                   "correlation_id": "%REQ(X-CORRELATION-ID)%",
                   "user_id": "%DYNAMIC_METADATA(envoy.filters.http.ext_authz:userId)%",
                   "api_id": "%DYNAMIC_METADATA(io.solo.gloo.apimanagement:api_id)%",
                   "api_product_id": "%DYNAMIC_METADATA(io.solo.gloo.apimanagement:api_product_id)%",
                   "api_product_name": "%DYNAMIC_METADATA(io.solo.gloo.apimanagement:api_product_name)%",
                   "usage_plan": "%DYNAMIC_METADATA(envoy.filters.http.ext_authz:usagePlan)%",
                   "custom_metadata": "%DYNAMIC_METADATA(io.solo.gloo.apimanagement:custom_metadata)%"
                 }
           revision: auto
     enabled: true
     northSouthGateways:
       - enabled: true
         installations:
           - gatewayRevision: auto
             istioOperatorSpec: {}
         name: istio-ingressgateway
   telemetryCollector:
     presets:
       logsCollection:
         enabled: true
         storeCheckpoints: true
     enabled: true
     config:
       exporters:
         otlp:
           endpoint: gloo-telemetry-gateway.gloo-mesh:4317
   telemetryCollectorCustomization: 
     pipelines:
       logs/portal: 
         enabled: true
   prometheus:
     enabled: true
   redis:
     deployment:
       enabled: true
   telemetryGateway:
     enabled: true
     service:
       type: ClusterIP
     extraEnvs:
     - name: CLICKHOUSE_PASSWORD
       valueFrom:
         secretKeyRef:
           key: password
           name: clickhouse-auth
   telemetryGatewayCustomization:
     pipelines:
       logs/clickhouse:
         enabled: true
     extraExporters:
       clickhouse:
         password: "${env:CLICKHOUSE_PASSWORD}"
   extAuthService:
     enabled: true
     extAuth:
       namespacedRbac:
       - resources:
         - secrets
         namespaces:
         - gloo-mesh
         - gloo-mesh-addons
       apiKeyStorage:
         name: redis
         enabled: true
         config:
           host: "redis.gloo-mesh-addons:6379"
           db: 0
         secretKey: "ThisIsSecret"
   glooPortalServer:
     enabled: true
     apiKeyStorage:
       redis:
         enabled: true
         address: redis.gloo-mesh-addons:6379
       configPath: /etc/redis-client-config/config.yaml
       secretKey: "ThisIsSecret"
   rateLimiter:
     enabled: true
   

4. Upgrade your Helm release with the namespaced RBAC restrictions. Be sure to include the Helm values file ($VALUES_FILE) that you previously created and the Gloo version of your current installation ($GLOO_VERSION).

   • If you have only one release for your installation, upgrade the gloo-platform release. Note that if you migrated from the legacy Helm charts, your Helm release might be named gloo-mgmt or gloo-mesh-enterprise instead.

     helm upgrade -i gloo-platform gloo-platform/gloo-platform \
        --namespace gloo-mesh \
        --create-namespace \
        --values $VALUES_FILE \
        --version $GLOO_VERSION
     

   • If you have a separate add-ons release, upgrade the gloo-agent-addons release.

     helm upgrade -i gloo-agent-addons gloo-platform/gloo-platform \
        --namespace gloo-mesh-addons \
        --create-namespace \
        --values $VALUES_FILE \
        --version $GLOO_VERSION
     

5. Verify that your Gloo environment is healthy. Note that this check might take a few seconds to complete.

   meshctl check
   

6. Confirm that the permissions are correct by checking the RBAC setup.