RBAC In Spinnaker - Groups, Application vs. Account Permissions and How to Use Them
summary
Step-by-step walkthrough shows enabling group SAML via Okta dev account, mapping groups into Spinnaker and Fiat, and configuring account-level permissions for clouds (Kubernetes namespaces example) and application-level read/write/execute controls. Fiat builds a permission cache and syncs on changes (syncs can take seconds to ~50s at scale); headers with many groups hit provider limits (~100–150) and inflate internal requests. Covers pipeline/service accounts vs. new pipeline roles, manual-judgment permission elevation, X509 auth, and artifact permissions currently not enforced.
AI-written summary · about
chapters (6)
- 0:00Authentication and groups
- 3:35Auth workflows and scaling
- 6:26Account permissions
- 13:10Application permissions
- 17:11Pipeline and trigger security
- 20:05Troubleshooting and resources
related talks
19mSpinnaker Deployments on Kubernetes from a Security Perspective
25mEnabling Diverse Application Use Cases using Spinnaker
23mBuild a Spinnaker pipeline in highly regulated bank environment
21mDynamic Account Management Framework for Spinnaker
43mGetting Started With Spinnaker (part 2)
35mRBAC to the Future: Untangling Authorization in Kubernetes
26mGetting Permission or Asking Forgiveness?
56mRBAC 101: Basics, Misconceptions, and the Real World