my en eu ne en eu en en en en en en eu eu en en en en en en en en en en en en en en en en en en en en en ne en en en en en en en en en en en en en en es en en cv it en en tr es en eo eu pl en pt en ca ja ca en en en en en en es en en en en en en en en en en en en en en en ne en en en en en en en en fi en en en en en pt en en en pt en en en pt en en en en en en en en en en en en en en ko en en en en en en en en en en en en fi en en en en en pt en en en pt ur en en pt en en en en en it fi en en fa fi en en en fi en en en ca en pt en en en en en en en en en en en en en ur en en en en en en en en en en en en en en en en en en en en en en en pt en en en en en en fi en en en en en en en en en en en en en
Users are defined via the User Custom Resource Definition. Users can be used to define the permissions for authenticated users and to customize the profile page.
In the following you can found the specification for the User CRD.
The email address of the authenticated user. This is used to connect the authenticated user with this CR.
A list of dashboards which will be shown on the users profile page.
Overwrite the global notification settings for this user.
Define a list of application permissions, to specify which applications can be accessed by a user
Define a list of teams (must match the corresponding group field of a team) which can be viewed by a user. The specifal character * can be used to allow a user to view all teams
A list of plugins, which can be accessed by a user.
A list of resources, which can be accessed by the user.
The type which should be used for the application permissions. This must be all to allow access to all applications, own to only allow access to applications owned by a team where the user is part of or custom to set the permissions based on satellites, clusters and namespaces.
A list of satellites from which applications can be accessed by the user, when the permission type is custom. The special character * can be used to include all satellites.
A list of clusters from which applications can be accessed by the user, when the permission type is custom. The special character * can be used to include all clusters.
A list of namespaces from which applications can be accessed by the user, when the permission type is custom. The special character * can be used to include all namespaces.
The satellite of the plugin instance, where it is configured. The special character * can be used to include all satellites.
The name of the plugin instance as it is defined in the configuration. The special character * can be used to include all names.
The type of the plugin instance as it is defined in the configuration. The special character * can be used to include all types.
The permissions, which should be grant to a user. The format of this property is different for each plugin. You can find an example for each plugin on the corresponding plugin page in the documentation.
A list of satellites to allow access to. The special list entry * allows access to all satellites.
A list of clusters to allow access to. The special list entry * allows access to all clusters.
A list of namespaces to allow access to. The special list entry * allows access to all namespaces.
A list of resources to allow access to. The special list entry * allows access to all resources.
A list of verbs to allow access to. The following verbs are possible: get, patch, post, delete and *. The special list entry * allows access for all verbs.
The following strings can be used in the resources list: cronjobs, daemonsets, deployments, jobs, pods, replicasets, statefulsets, endpoints, horizontalpodautoscalers, ingresses, networkpolicies, services, configmaps, persistentvolumeclaims, persistentvolumes, poddisruptionbudgets, secrets, serviceaccounts, storageclasses, clusterrolebindings, clusterroles, rolebindings, roles, events, nodes, podsecuritypolicies.
The special terms pods/log and pods/exec can be used to allow users to get the logs or a terminal for a Pod. To download / upload a file from / to a Pod a user also needs the pods/exec resource. The pods/log and pods/exec permission can only be set together with the * value for the verbs parameter.
A Custom Resource can be specified in the following form  . /  (e.g. vaultsecrets.ricoberger.de/v1alpha1).
A list of notification groups, which should be used for this user.
The title for the notification group.
The plugin configuration for the notification group.
In the CR defines that the user with the email rico@kobs.io can view all applications and teams. He can also view the Helm charts in the bookinfo and kobs namespace and can use the Opsgenie plugin. Besides that he can also list, edit and delete all resources in the bookinfo and kobs namespace.
--- apiVersion: kobs.io/v1 kind: User metadata: name: ricoberger namespace: kobs spec: email: rico@kobs.io permissions: applications: - type: all teams: - "*" plugins: - satellite: "*" name: helm type: helm permissions: - clusters: - "*" namespaces: - "bookinfo" - "kobs" names: - "*" - satellite: "*" name: opsgenie type: opsgenie permissions: - acknowledgeAlert - snoozeAlert - closeAlert resources: - satellites: - "*" clusters: - "*" namespaces: - "bookinfo" - "kobs" resources: - "*" verbs: - "*"