Manage Role Bindings on StreamNative Cloud
This guide covers both basic and advanced techniques for managing role bindings. Recommend to reviewing the Predefined Role for a complete list of available roles and for examples of how to binding them.
You can manage role bindings by using snctl or StreamNative Terraform Provider. Support for the Cloud Console will be available soon.
Role Bindings
Role bindings are used to bind roles to principals. They are defined as RoleBinding
resources in the Cloud API. The schema is as follows:
roleRef
: Reference to the Predefined Role.subjects
: List of subjects (also known as principals) to be bound to the role. It can be a [User Account]](/cloud/security/authentication/user-accounts), a ServiceAccount, or an IdentityPool.
Create Role Bindings
You can create a role binding by using the following methods:
You can create a role binding by running the following command to bind a predefined role <predefined-role-name>
to a service account <service-account-name>
.
Alternatively, you can prepare the manifest file rolebinding.yaml
to bind a predefined role to a service account.
Then apply it using snctl apply
.
After creating the role binding, you can verify it by running the following command:
You should be able to see the role binding is in the Ready
state.
You can create a role binding by running the following command to bind a predefined role <predefined-role-name>
to a service account <service-account-name>
.
Alternatively, you can prepare the manifest file rolebinding.yaml
to bind a predefined role to a service account.
Then apply it using snctl apply
.
After creating the role binding, you can verify it by running the following command:
You should be able to see the role binding is in the Ready
state.
You can create a role binding by preparing the role binding definition in the Terraform configuration and applying the changes. Below is an example of binding a predefined role to a service account.
Please replace the placeholders with your actual values.
<organization-id>
: The ID of your organization.<predefined-role-name>
: The name of the predefined role.<service-account-name>
: The name of the service account.
After preparing the Terraform configuration, you can apply the changes using the following command:
Update Role Bindings
You can update a role binding by using the following methods:
You can use snctl edit
to update a role binding directly.
Alternatively, you can update the file rolebinding.yaml
and apply it using snctl apply
.
You can use snctl edit
to update a role binding directly.
Alternatively, you can update the file rolebinding.yaml
and apply it using snctl apply
.
You can update the role binding definition in the Terraform configuration and apply the changes.
Delete Role Bindings
You can delete a role binding by using the following methods:
Delete a role binding:
Delete a role binding:
You can simply remove the role binding definition from the Terraform configuration and apply the changes.
Query Role Bindings
Search Role Bindings By Role Name
A simple method for searching Role Bindings by roleName
is provided, with efficient query support coming soon.
${role_name}
refers to a predefined role
Search Role Bindings By Account Name
A simple method for searching Role Bindings by accountName
is provided, with efficient query support coming soon.
${account_name}
is the name of the user account or service account.
Conditional Role Bindings
While basic role bindings simply associate a role with a user or service account, conditional role bindings provide more granular control by scoping permissions based on resource attributes.
For example, you may want to restrict a topic-producer role to only work within a specific namespace. StreamNative Cloud allows you to express these conditions using below ways:
- Resource Name.
- Common Expression Language (CEL) for complex restriction.
The following example shows how to bind the topic-producer
role to a service account named service-account-1
with conditions that limit its access to:
- Instance:
ins-a
- Cluster:
cluster-a
- Tenant:
tenant-a
- Namespace:
ns-a
With these conditions, service-account-1
can only produce messages to topics within the specified namespace (tenant-a/ns-a
) on that particular instance and cluster.
Using resource name:
Using CEL expression:
Please use latest version of snctl
and streamnative
provider for Terraform when creating RoleBindings.
The Resource Name and CEL expression supports accessing resources through the following variable:
- StreamNative Resource Name (SRN): Provides access to all resources within the hierarchy, from instance and cluster down to individual resources like tenants, namespaces, topics, and subscriptions.
StreamNative Resource Name (SRN)
A StreamNative Resource Name (SRN) uniquely identifies resources in StreamNative Cloud using a hierarchical structure. The SRN is accessed through the srn
variable in CEL expressions and contains the following fields:
instance
: The StreamNative Cloud instancecluster
: The Pulsar clustertenant
: The tenantnamespace
: The namespacetopic_domain
: The topic domain (persistent or non-persistent)topic_name
: The name of the topicsubscription
: The subscription nameservie_account
: The service account name (used for “service-account-admin” role)secret
: The secret name (used for “secret” role)
For example, to scope a role binding to specific resources, you can create it with below arguments:
Complex Conditional Role Bindings
CEL supports complex conditional role bindings that allow for more sophisticated access control patterns than using the resource name.
For example, to bind a user as tenant-admin
for multi resources:
- Tenant:
tenant-a
andtenant-b
- Cluster:
cluster-a
andcluster-b
- Instance:
ins-1
andins-2
The CEL expression would be: