Skip to main content
Loading
Version: Operator 1.x.x

Aerospike Access Control

Aerospike Access Control includes user, role, and privilege creation and maintenance. For more details see here.

To manage your access controls from the operator, configure the aerospikeAccessControl section in the Aerospike cluster's Custom Resource (CR) file.

danger

Access control changes on an operator-managed Aerospike cluster will be reverted if made externally (e.g. using aql or asadm).

Here are a few examples for common access control tasks:

note

For these examples, assume that cluster is deployed using a file named aerospike-cluster.yaml.

Creating a roleโ€‹

Add a role in roles list under aerospikeAccessControl.

sys-admin and user-admin are standard predefined roles. Here we are adding a new custom role called "profiler" which is given read privileges.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
roles:
- name: profiler
privileges:
- read
users:
- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

To apply the change, run this command:

kubectl apply -f aerospike-cluster.yaml

Adding privileges to a roleโ€‹

Add the read and read-write privileges to the profiler role in roles list under aerospikeAccessControl.


apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
roles:
- name: profiler
privileges:
- read
- read-write
users:
- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

To apply the change, run this command

kubectl apply -f aerospike-cluster.yaml

Removing privileges from a roleโ€‹

Remove privileges from the desired role in roles list under aerospikeAccessControl.

Remove read-write privilege.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
roles:
- name: profiler
privileges:
- read
users:
- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

Apply the change by running apply with the updated config.

kubectl apply -f aerospike-cluster.yaml

Creating a user with rolesโ€‹

Create the secret for the user and add the user in users list under aerospikeAccessControl.

Create a secret profile-user-secret containing the password for the user profiler by passing the password from the command line:

kubectl  -n aerospike create secret generic profile-user-secret --from-literal=password='userpass'

Add profileUser user having profiler role.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
roles:
- name: profiler
privileges:
- read
users:
- name: profileUser
secretName: profile-user-secret
roles:
- profiler

- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

Apply the change:

kubectl apply -f aerospike-cluster.yaml

Add new roles to a userโ€‹

Add roles in the desired user's roles list.

Add user-admin, sys-admin in profileUser roles list.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
roles:
- name: profiler
privileges:
- read
users:
- name: profileUser
secretName: profile-user-secret
roles:
- profiler
- user-admin
- sys-admin

- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

Apply the change:

kubectl apply -f aerospike-cluster.yaml

Removing roles from a userโ€‹

Remove roles from the desired user's roles list.

Remove sys-admin from the profileUser's roles list.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
roles:
- name: profiler
privileges:
- read
users:
- name: profileUser
secretName: profile-user-secret
roles:
- profiler
- user-admin

- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

Apply the change:

kubectl apply -f aerospike-cluster.yaml

Changing a user's passwordโ€‹

Create a new secret new-profile-user-secret containing the password for Aerospike cluster user profileUser by passing the password from the command line:

kubectl  -n aerospike create secret generic new-profile-user-secret --from-literal=password='newuserpass'

Update the secretName for profileUser to the new secret name new-profile-user-secret.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
roles:
- name: profiler
privileges:
- read
users:
- name: profileUser
secretName: new-profile-user-secret
roles:
- profiler
- user-admin

- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

Apply the change:

kubectl apply -f aerospike-cluster.yaml

Dropping a roleโ€‹

Remove the desired role from roles list under aerospikeAccessControl. Also remove this role from the roles list of all the users.

Remove profiler role.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
users:
- name: profileUser
secretName: new-profile-user-secret
roles:
- sys-admin

- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

Apply the change:

kubectl apply -f aerospike-cluster.yaml

Dropping a userโ€‹

Remove the desired user from the users list under aerospikeAccessControl.

Remove profileUser user.

apiVersion: aerospike.com/v1alpha1
kind: AerospikeCluster
metadata:
name: aerocluster
namespace: aerospike

spec:
.
.
aerospikeAccessControl:
users:
- name: admin
secretName: auth-secret
roles:
- sys-admin
- user-admin

Apply the change:

kubectl apply -f aerospike-cluster.yaml