|
1 | 1 | # Access Restrictions |
2 | 2 |
|
3 | | -The dashboard can be configured with access restrictions. |
| 3 | +For an overview and usage of access restrictions, refer to the [Access Restrictions Usage Documentation](https://github.com/gardener/gardener/blob/master/docs/usage/shoot/access_restrictions.md). |
4 | 4 |
|
5 | | -<img src="../images/access-restrictions-1.png"> |
| 5 | +## Configuring the Dashboard |
6 | 6 |
|
7 | | -Access restrictions are shown for regions that have a matching label in the `CloudProfile` |
8 | | -```yaml |
9 | | - regions: |
10 | | - - name: pangaea-north-1 |
11 | | - zones: |
12 | | - - name: pangaea-north-1a |
13 | | - - name: pangaea-north-1b |
14 | | - - name: pangaea-north-1c |
15 | | - labels: |
16 | | - seed.gardener.cloud/eu-access: "true" |
17 | | -``` |
| 7 | +Operators can configure the Gardener Dashboard to define available access restrictions and their options. This configuration determines what is displayed to end-users in the Dashboard UI. |
18 | 8 |
|
19 | | -- If the user selects the access restriction, `spec.seedSelector.matchLabels[key]` will be set. |
20 | | -- When selecting an option, `metadata.annotations[optionKey]` will be set. |
| 9 | +### Configuration Methods |
21 | 10 |
|
22 | | -The value that is set depends on the configuration. See _2._ under _Configuration_ section below. |
| 11 | +The Dashboard can be installed and configured in two ways: |
23 | 12 |
|
24 | | -```yaml |
25 | | -apiVersion: core.gardener.cloud/v1beta1 |
26 | | -kind: Shoot |
27 | | -metadata: |
28 | | - annotations: |
29 | | - support.gardener.cloud/eu-access-for-cluster-addons: "true" |
30 | | - support.gardener.cloud/eu-access-for-cluster-nodes: "true" |
31 | | - ... |
32 | | -spec: |
33 | | - seedSelector: |
34 | | - matchLabels: |
35 | | - seed.gardener.cloud/eu-access: "true" |
36 | | -``` |
| 13 | +1. **Via Helm Chart**: Configuration is provided through the `values.yaml` file. |
| 14 | +2. **Via Gardener Operator**: Configuration is provided through a ConfigMap referenced by the Gardener Operator. |
37 | 15 |
|
38 | | -In order for the shoot (with enabled access restriction) to be scheduled on a seed, the seed needs to have the label set. E.g. |
39 | | -```yaml |
40 | | -apiVersion: core.gardener.cloud/v1beta1 |
41 | | -kind: Seed |
42 | | -metadata: |
43 | | - labels: |
44 | | - seed.gardener.cloud/eu-access: "true" |
45 | | -... |
46 | | -``` |
| 16 | +#### 1. Installing via Helm Chart |
| 17 | + |
| 18 | +When installing the Dashboard via Helm chart, access restrictions are configured in the `values.yaml` file. |
47 | 19 |
|
48 | | -<img src="../images/access-restrictions-2.png"> |
| 20 | +**Example `values.yaml`:** |
49 | 21 |
|
50 | | -**Configuration** |
51 | | -As gardener administrator: |
52 | | -1. you can control the visibility of the chips with the `accessRestriction.items[].display.visibleIf` and `accessRestriction.items[].options[].display.visibleIf` property. E.g. in this example the access restriction chip is shown if the value is true and the option is shown if the value is false. |
53 | | -2. you can control the value of the input field (switch / checkbox) with the `accessRestriction.items[].input.inverted` and `accessRestriction.items[].options[].input.inverted` property. Setting the `inverted` property to `true` will invert the value. That means that when selecting the input field the value will be`'false'` instead of `'true'`. |
54 | | -3. you can configure the text that is displayed when no access restriction options are available by setting `accessRestriction.noItemsText` |
55 | | -example `values.yaml`: |
56 | 22 | ```yaml |
57 | 23 | accessRestriction: |
58 | 24 | noItemsText: No access restriction options available for region {region} and cloud profile {cloudProfile} |
59 | 25 | items: |
60 | | - - key: seed.gardener.cloud/eu-access |
| 26 | + - key: eu-access-only |
61 | 27 | display: |
62 | | - visibleIf: true |
63 | | - # title: foo # optional title, if not defined key will be used |
64 | | - # description: bar # optional description displayed in a tooltip |
| 28 | + title: EU Access Only # Optional title; if not specified, `key` is used |
| 29 | + description: Restricts access to EU regions only # Optional description displayed in a tooltip |
65 | 30 | input: |
66 | 31 | title: EU Access |
67 | 32 | description: | |
68 | | - This service is offered to you with our regular SLAs and 24x7 support for the control plane of the cluster. 24x7 support for cluster add-ons and nodes is only available if you meet the following conditions: |
| 33 | + This service is offered with our regular SLAs and 24x7 support for the control plane of the cluster. 24x7 support for cluster add-ons and nodes is only available if you meet the following conditions: |
69 | 34 | options: |
70 | 35 | - key: support.gardener.cloud/eu-access-for-cluster-addons |
71 | 36 | display: |
72 | | - visibleIf: false |
73 | | - # title: bar # optional title, if not defined key will be used |
74 | | - # description: baz # optional description displayed in a tooltip |
| 37 | + visibleIf: true # Controls visibility based on a condition |
75 | 38 | input: |
76 | | - title: No personal data is used as name or in the content of Gardener or Kubernetes resources (e.g. Gardener project name or Kubernetes namespace, configMap or secret in Gardener or Kubernetes) |
| 39 | + title: No personal data is used in resource names or contents |
77 | 40 | description: | |
78 | | - If you can't comply, only third-level/dev support at usual 8x5 working hours in EEA will be available to you for all cluster add-ons such as DNS and certificates, Calico overlay network and network policies, kube-proxy and services, and everything else that would require direct inspection of your cluster through its API server |
79 | | - inverted: true |
| 41 | + If you can't comply, only third-level support during usual 8x5 working hours in the EEA will be available for cluster add-ons. |
| 42 | + inverted: false # Determines if the input value is inverted |
80 | 43 | - key: support.gardener.cloud/eu-access-for-cluster-nodes |
81 | 44 | display: |
82 | | - visibleIf: false |
| 45 | + visibleIf: false # Controls visibility based on a condition |
83 | 46 | input: |
84 | | - title: No personal data is stored in any Kubernetes volume except for container file system, emptyDirs, and persistentVolumes (in particular, not on hostPath volumes) |
| 47 | + title: No personal data is stored in Kubernetes volumes except certain types |
85 | 48 | description: | |
86 | | - If you can't comply, only third-level/dev support at usual 8x5 working hours in EEA will be available to you for all node-related components such as Docker and Kubelet, the operating system, and everything else that would require direct inspection of your nodes through a privileged pod or SSH |
87 | | - inverted: true |
88 | | -``` |
| 49 | + If you can't comply, only third-level support during usual 8x5 working hours in the EEA will be available for node-related components. |
| 50 | + inverted: true # Determines if the input value is inverted |
| 51 | +``` |
| 52 | +
|
| 53 | +#### 2. Installing via Gardener Operator |
| 54 | +
|
| 55 | +When the Dashboard is installed via the Gardener Operator, access restrictions are configured in a separate `ConfigMap` referenced by the Operator using `.spec.virtualCluster.gardener.gardenerDashboard.frontendConfigMapRef` within the `Garden` resource. |
| 56 | + |
| 57 | +**Example ConfigMap:** |
| 58 | + |
| 59 | +```yaml |
| 60 | +apiVersion: v1 |
| 61 | +kind: ConfigMap |
| 62 | +metadata: |
| 63 | + name: gardener-dashboard-frontend |
| 64 | + namespace: garden |
| 65 | +data: |
| 66 | + frontend-config.yaml: | |
| 67 | + accessRestriction: |
| 68 | + noItemsText: No access restriction options available for region {region} and cloud profile {cloudProfile} |
| 69 | + items: |
| 70 | + - key: eu-access-only |
| 71 | + display: |
| 72 | + title: EU Access Only |
| 73 | + description: Restricts access to EU regions only |
| 74 | + input: |
| 75 | + title: EU Access |
| 76 | + description: | |
| 77 | + This service is offered with our regular SLAs and 24x7 support for the control plane of the cluster. 24x7 support for cluster add-ons and nodes is only available if you meet the following conditions: |
| 78 | + options: |
| 79 | + - key: support.gardener.cloud/eu-access-for-cluster-addons |
| 80 | + display: |
| 81 | + visibleIf: true |
| 82 | + input: |
| 83 | + title: No personal data is used in resource names or contents |
| 84 | + description: | |
| 85 | + If you can't comply, only third-level support during usual 8x5 working hours in the EEA will be available for cluster add-ons. |
| 86 | + inverted: false |
| 87 | + - key: support.gardener.cloud/eu-access-for-cluster-nodes |
| 88 | + display: |
| 89 | + visibleIf: false |
| 90 | + input: |
| 91 | + title: No personal data is stored in Kubernetes volumes except certain types |
| 92 | + description: | |
| 93 | + If you can't comply, only third-level support during usual 8x5 working hours in the EEA will be available for node-related components. |
| 94 | + inverted: true |
| 95 | +``` |
| 96 | + |
| 97 | +### Understanding `input` and `display` |
| 98 | + |
| 99 | +- **`display`**: |
| 100 | + - **Purpose**: Defines how the access restriction and its options are presented in the Dashboard UI using **chips**. |
| 101 | + - **Properties**: |
| 102 | + - `title`: Label shown on the chip. If not specified, `key` is used. |
| 103 | + - `description`: Tooltip content when hovering over the chip. |
| 104 | + - `visibleIf` (for options): Determines if the option's chip is displayed based on its value. |
| 105 | + |
| 106 | +- **`input`**: |
| 107 | + - **Purpose**: Configures the interactive elements (switches, checkboxes) that users interact with to enable or disable access restrictions and options. |
| 108 | + - **Properties**: |
| 109 | + - `title`: Label for the input control. |
| 110 | + - `description`: Detailed information or instructions for the input control. |
| 111 | + - `inverted` (for options): Determines if the input value is inverted (`true` or `false`). When `inverted` is `true`, the control behaves inversely (e.g., checked means `false`). |
| 112 | + |
| 113 | +### No Access Restrictions Available |
| 114 | + |
| 115 | +If no access restrictions are available for the selected region and cloud profile, the text specified in `accessRestriction.noItemsText` is displayed. Placeholders `{region}` and `{cloudProfile}` can be used in the text. |
0 commit comments