This is a beta version. gitlab2rbac is still undergoing final testing before its official release.

gitlab2rbac ensures that your Kubernetes cluster users have the same permissions than on GitLab.

It takes GitLab Permissions by project as input and generates RBAC objects inside Kubernetes.

Before anything else, gitlab2rbac requires:

• RBAC enabled on your Kubernetes cluster
• GitLab API with v4 support

gitlab2rbac needs a namespace, cluster roles and cluster role bindings. Create them with:

$ kubectl apply -f https://raw.githubusercontent.com/numberly/gitlab2rbac/master/deploy/configuration.yaml

You will then need to create a ConfigMap that contains all the useful information for gitlab2rbac:

cat <<EOF | kubectl create -f -
apiVersion: v1
kind: ConfigMap
metadata:
  name: gitlab2rbac
  namespace: gitlab2rbac
data:
  GITLAB_URL: https://{{ your GitLab instance URL }}
  GITLAB_PRIVATE_TOKEN: {{ your GitLab private token }}
  KUBERNETES_LOAD_INCLUSTER_CONFIG: "True"
EOF

Finally, just apply the manifest:

$ kubectl apply -f https://raw.githubusercontent.com/numberly/gitlab2rbac/master/deploy/gitlab2rbac.yaml

This will deploy gitlab2rbac to your cluster, under the gitlab2rbac namespace. The components in the manifest are:

• the deployment, which is the cluster-wide controller that handles RBAC policies
• the service account and the RBAC permissions that the controller need to function

• Python 3 (should also work with Python 2 but it's not supported)
• Virtualenv (recommended)

Even if gitlab2rbac doesn't run inside Kubernetes, it needs a cluster with existing cluster roles. Create them with:

$ kubectl apply -f https://raw.githubusercontent.com/numberly/gitlab2rbac/master/deploy/configuration.yaml

Then you can clone the repository, install the dependencies and run gitlab2rbac:

$ git clone https://github.com/numberly/gitlab2rbac.git
$ cd gitlab2rbac
$ virtualenv .venv && source .venv/bin/activate
(.venv) $ pip install -r requirements.txt
(.venv) $ GITLAB_URL={{ your GitLab instance URL }} GITLAB_PRIVATE_TOKEN={{ your GitLab private token }} python gitlab2rbac.py

What we mean by R and W is defined by Kubernetes API verbs:

• Read (R): get, list, watch
• Write (W): create, update, patch, delete, deletecollection

Any authenticated user has access to those cluster-wide resources:

• apiservices
• componentstatuses
• namespaces
• nodes

Any admin on GitLab is an admin of the Kubernetes cluster.

gitlab2rbac supports multiple environment variables for advanced configuration:

MIT