Kubernetes dashboard

Introduction

Your Plural console comes with a fully embedded Kubernetes dashboard. This is meant to solve for a few things:

• Simplifying Kubernetes API access: No need to juggle kubeconfigs, VPNs, etc. to understand your Kubernetes clusters. It also connects directly to your OIDC provider, so it uses an approved auth flow.
• Simplifying networking: all traffic to managed clusters uses the same unidirectional egress networking from the Plural agent as deployments do. That way you can retain visibility into private and on-prem clusters.
• Better UI: you'll get all the benefits of Plural's UI/UX in your Kubernetes dashboard experience.

RBAC

The dashboard uses Kubernetes Impersonation to authenticate to Kubernetes using your Console identity. That means all RBAC resolves to your Console user email and groups, which are themselves connected to your identity provider. On net, this should give you an effective Kubernetes SSO experience.

To create RBAC rules for your Console user, you'd use something like:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: sre-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: Group
    name: sre

This grants the cluster-admin role to all users within the sre group. Alternatively:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: someones-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - apiGroup: rbac.authorization.k8s.io
    kind: User
    name: someone@your.company.com

This grants the same role only to the someone@your.company.com user email.