Skip to main content
In this tutorial we will use SAML and ACLs to control fine-grained access to Kubernetes clusters. Let’s assume that at our organization:
  • We run a Keycloak instance as the SAML identity provider.
  • Have our Omni instance already configured to use Keycloak as the SAML identity provider.
  • Our Omni instance has 2 types of clusters:
    • Staging clusters with the name prefix staging-: staging-1, staging-2, etc.
    • Production clusters with the name prefix prod-: prod-1, prod-2, etc.
  • We want the users with the SAML role omni-cluster-admin to have full access to all clusters.
  • We want the users with the SAML role omni-cluster-support to have full access to staging clusters and read-only access to production clusters.

​
Sign in as the initial SAML User

If our Omni instance has no users yet, the initial user who signs in via SAML will be automatically assigned to the Omni Admin role. We sign in as the user admin@example.org and get the Omni Admin role.

​
Configuring the AccessPolicy

We need to configure the ACL to assign the omni-cluster-support role to the users with the SAML role omni-cluster-support and the omni-cluster-admin role to the users with the SAML role omni-cluster-admin. Create the following YAML file acl.yaml:
As the admin user admin@example.org, apply this ACL using omnictl:

​
Accessing the Clusters

Now, in an incognito window, log in as a support engineer, cluster-support-1@example.org. Since the user is not assigned to any Omni role yet, they cannot use Omni Web. Download omnictl and omniconfig from the UI, and try to list the clusters by using it:
You won’t be able to list the clusters because the user is not assigned to any Omni role. Now try to get the cluster staging-1:
You can get the cluster staging-1 because the ACL allows the user to access the cluster. Finally, try to delete the cluster staging-1:
The operation will succeed, because the ACL allows Operator-level access to the cluster for the user. Try to do the same operations with the cluster prod-1:
The user will be able to get the cluster but not delete it, because the ACL allows only Reader-level access to the cluster for the user. If you do the same operations as the admin user, you’ll notice that you are able to both get and delete staging and production clusters.

​
Assigning Omni roles to Users

If you want to allow SAML users to use Omni Web, you need to assign them at least the Reader role. As the admin, sign in to Omni Web and assign the role Reader to both cluster-support-1@example.org and cluster-admin-1@example.org. Now, as the support engineer, you can sign out & sign in again to Omni Web and see the clusters staging-1 and prod-1 in the UI.