How to add user to TERRAKUBE_ADMIN group without requesting for groups from Google?

[maordavidov]

I'd like to avoid requesting access to the user's groups if it's possible. What options do I have?

I'm using DEX with Google authentication only

[alfespa17]

You don't really need to use TERRAKUBE_ADMIN, that is just the default administrator groups.

If you have any other group you could use it, just override the value in the helm chart

Something like:

security:
  adminGroup: "[email protected]"

Reference: https://github.com/AzBuilder/terrakube-helm-chart/tree/main#2-terrakube-admin-group-and-internal-security

[maordavidov]

@alfespa17 I understand that, I want to avoid using groups at all. Is it possible to specify list of users?
In order to use groups I will need to ask from my google directory to return the list of groups I belong to, while the same login is used for many companies with their directory, and potentially they can add the same group to their directory and receive admin permissions.

[alfespa17]

Hello @maordavidov

Right now there is no way to add user to the admin group something like "local accounts" because we validate the list of groups that comes from the Dex Token.

If you dont want to handle groups and users inside google cloud identity you could connect DEX to some other identity solution where you can handle the users/groups, for example when we deploy Terrakube using minikube by default it is using a OpenLDAP to handle the users.

Maybe you could use something like this:

Reference:
https://github.com/AzBuilder/terrakube-helm-chart/blob/main/charts/terrakube/templates/secret-openldap.yaml
https://github.com/AzBuilder/terrakube-helm-chart/blob/main/charts/terrakube/templates/deployment-openldap.yaml

You could use also check the Dex documentation maybe you could use some other connecto that you can use.

Regarding adding the group TERRAKUBE_ADMIN in different directories I think that wont be an issue because each directory has a different domains and you can even set de groups that have access inside the Dex configuration and when you add the configuration you set the clientID and clientSecret and that will only work for one particular google cloud identity directory.

You can even restric more the groups that have access adding this part in the Dex configuration where you put the group name and the domain.

    # The Google connector supports whitelisting allowed groups when using G Suite
    # (Google Apps). The following field can be set to a list of groups
    # that can log in:
    #
    # groups:
    #  - [email protected]

I hope this information can help you.

[maordavidov]

I see, I'll consider setting up management dex in that case with limited access