samirtahir91076/jira-jit-rbac-operator repository overview

https://github.com/samirtahir91/jira-jit-rbac-operator?tab=readme-ov-file⁠

⁠jira-jit-rbac-operator

The jira-jit-rbac-operator is a Kubernetes operator that creates short-lived rolebindings for users based on a JitRequest custom resource. It integrates with a configurable Jira Workflow, the operator submitts a Jira ticket in a Jira Project for approval by a Human before granting the role-binding for the requested time period. It empowers self-service of Just-In-Time privileged access using Kubernetes RBAC.

⁠Description

⁠Key Features

• Uses a custom cluster scoped resource JitRequest, where a user creates a JitReuest with:
  • reporter
  • clusterRole
  • additionalEmails (optional users to also add to role binding)
  • namespaces
  • namespaceLabels (optional)
  • justification
  • startTime
  • endTime
  • JiraFields (custom fields defined by JustInTimeConfig's customFields)
• The operator checks if the JitRequest's cluster role is allowed, from the allowedClusterRoles list defined in a JustInTimeConfig custom resource (set by admins/operators) and then pre-approves the request.
• Submits the request as a Jira Ticket to a configured Jira Project with the details as per the JitRequest spec.
• Requeues the JitRequest object for the defined startTime and checks the Jira Ticket for approval status
• Creates the RoleBinding as requested if Jira Ticket is approved, rejects and cleans-up JitRequest if the Jira Ticket is not approved.
• Deletes expired JitRequests and child objects (RoleBindings) at scheduled endTime.

⁠Configuration for Jira

⁠Create Jira API Token Secret

• Create a Jira account for the operator and generate a PAT (personal access token).
• Grant the account permission to modify reporters on the target Jira project.
• Grant the account permission to create/update issues in the target Jira project.
• Create a secret for the PAT

kubectl -n jira-jit-rbac-operator-system create secret generic \
  jira-credentials \
  --from-literal=api-token=<PERSONAL ACCESS TOKEN>

⁠Project and Workflow configuration

The operator is configurable for a Jira project and Workflow using the JustInTimeConfig custom resource sample⁠

You will need to create the required custom fields in Jira to be used by the workflow and map them to the JustInTimeConfig, i.e.:

The sample workflow used is here⁠, you need to import⁠/create an identical Workflow in your Jira Project (the IDs of fields etc are configurable as below).

You must define these with the values according to your Jira Project and Workflow (to map the fields from your workflow to the opertor's config):

The customFields are completely configurable to what fields you want a user to define a value for in a JitRequest
Each custom field is sent in the payload to Jira on creation of a new issue.
This allows you to use whatever fields as per your workflow.

Detail:

• Each customField requires a type and jiraCustomField
• Each custom field is required in JitRequest.Spec.JiraFields
• I.e. If I add ProductOwner as a custom field, then all users will need to define JiraFields.ProductOwner in my JitRequest
• Example custom fields and data types:

  Custom Field	Type
  Reporter	Text
  ProductOwner	User Select
  Justification	Text multiline

⁠Logging and Debugging

• By default, logs are JSON formatted, and log level is set to info and error.
• Set DEBUG_LOG to true in the manager deployment environment variable for debug level logs.

⁠Additional Information

• The CRD includes extra data printed with kubectl get jitreq:
  • User
  • Cluster Role
  • Namespace
  • Start Time
  • End Time
• Events are recorded for:
  • Rejected JitRequests
  • Failure to create a RoleBinding for a JitRequest
  • Validation on allowed cluster roles

⁠Example JitRequest Resource

Here is an example of how to define the JitRequest resource:

apiVersion: justintime.samir.io/v1
kind: JitRequest
metadata:
  name: jitrequest-sample
spec:
  userEmail: [email protected]
  additionalEmails:
    - "[email protected]"
    - "[email protected]"
  namespaces: 
    - foo
    - bar
  namespaceLabels:
    foo: bar
  startTime: 2025-01-18T11:48:10Z
  endTime: 2025-01-18T11:51:10Z
  clusterRole: edit
  jiraFields:
    Approver: admin
    ProductOwner: admin
    Justification: "need a jit now pls"

Above the jiraFields are mapped to the customFields in the JustInTimeConfig:

apiVersion: justintime.samir.io/v1
kind: JustInTimeConfig
metadata:
  name: jira-jit-rbac-operator-default
spec:
  allowedClusterRoles:
    - admin
    - edit
  labels:
    - minikube-test
  namespaceAllowedRegex: ".*"
  environment:
    environment: local
    cluster: minikube
  additionalCommentText: "cluster: minikube"
  workflowApprovedStatus: "Approved"
  rejectedTransitionID: "21"
  jiraProject: IAM
  jiraIssueType: Access Request
  completedTransitionID: "41"
  requiredFields:
    ClusterRole:
      type: "select"
      jiraCustomField: "customfield_10115"
    StartTime:
      type: "date"
      jiraCustomField: "customfield_10200"
    EndTime:
      type: "date"
      jiraCustomField: "customfield_10201"
  customFields:
    Approver:
      type: "user"
      jiraCustomField: "customfield_10112"
    ProductOwner:
      type: "user"
      jiraCustomField: "customfield_10113"
    Justification:
      type: "text"
      jiraCustomField: "customfield_10114"