Members and access

Access is given with membership objects, never by editing RBAC directly.

Roles

Role	Granted by	Can
workspace-admin	WorkspaceMembership	Everything in the workspace: members, namespaces, VPCs, buckets, disks, public IPs, plans and vouchers
workspace-reader	WorkspaceMembership	Read everything in the workspace
namespace-admin	NamespaceMembership	Everything inside the namespace, including members
namespace-member	NamespaceMembership	Create and run workloads, no member management
namespace-reader	NamespaceMembership	Read the namespace

Give someone one project

The person needs a WorkspaceMembership first (any role, or none with an empty roleRefs).

!membership.yaml×

tapsicloud › membership.yaml

1apiVersion: iam.tapsicloud.com/v1alpha1
2kind: NamespaceMembership
3metadata: {name: bob, namespace: production}
4spec:
5  subject: {kind: User, name: bob@example.com}
6  roleRefs: [{kind: ClusterRole, name: namespace-member}]

✓ dry-runLn 6 · YAML

zsh

❯ kubectl auth can-i create virtualmachines.compute.tapsicloud.com -n production

Service accounts

Create a service account in a namespace for CI and apps and grant it a role. The console never displays a token; it gives you the kubectl create token command that mints a short-lived one.