servala/servala-portal
3
0
Fork 0
Code Issues 21 Pull requests 5 Projects 2 Releases Packages 2 Activity Actions

move over documentation from old place
All checks were successful
Build and Deploy Antora Docs / build (push) Successful in 38s
Details
Build and Deploy Antora Docs / deploy (push) Successful in 5s
Details

Browse source
This commit is contained in:
Tobias Brunner 2025-03-11 15:37:13 +01:00
parent 16e8c2729b
commit d61465b6ea
No known key found for this signature in database
11 changed files with 1184 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

23
docs/modules/ROOT/pages/control-planes.adoc Normal file
View file

@ -0,0 +1,23 @@
= Service Provider Control Planes
Control Planes are Kubernetes API endpoints, reachable directly from the Web Portal. It represents a datacenter ("Zone") of a Service Provider.
A Service Provider can have multiple zones.
The portal connects to these Kubernetes API endpoints by using the official https://github.com/kubernetes-client/python[Python Kubernetes Client^].
Every control plane is registered in the portal database with connection details, names and other metadata (description, location, service provider, zone, logo, etc.).
Authentication happens via different mechanisms, depending on the task at hand:
System Connections::
Certain operations are initiated directly by the portal, for example retrieving the available service definitions (XRDs).
This is done via a dedicated Service Account token, having stringent RBAC rules on the cluster.
User Connections::
Tasks like creating, listing, updating, or deleting service instances is done in the users context. On the Kubernetes API, we take appropriate measure to secure the access.
For acting in the users context, we use:
. https://www.keycloak.org/securing-apps/token-exchange[OIDC Token Exchange] to get a token to authenticate in the users context against the control plane API.
. https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation[User impersonation] by using the system connections credentials.
Not all users and organizations have access to all control planes, therefore we implement access control on a user and organization level to control planes.
This way we filter the available service providers available.