Hi, my name is Denys van Kempen, SAP HANA Academy and SAP’s Partner Innovation Lab
In this video tutorial series we are going to explore the Kyma runtime of the SAP Business
Technology platform.
This video was recorded in January 2022.
For the latest tutorials on the topic, please check the playlist.
In this video, we cover a security topic: assigning role collections using the BTP cockpit
and the BTP CLI.
In the previous video we created a service instance of the Kyma runtime and tried to
access the Kyma dashboard but got an access denied message: not enough permissions.
How can we fix this?
As documented, there are two predefined roles for the Kyma environment: a Kyma Runtime Namespace
Admin role and Developer role.
Here we see them listed, under security, roles for the subaccount.
Both roles have been added to a role collection with the same name.
Depending on how SAP BTP security has been configured, normally you would map the role
collection to a group and than add users to this group at the Identity provider level,
Azure Active Directory for example.
Here we are using the default identity provider of BTP, SAP ID services, with only a single
user account defined, which we can grant to ourselves.
and then repeat the activity for the developer role collection.
If we then return to the Kyma environment Sign out
and sign in again OK.
we are back to the subaccount home page well, we can access the dashboard also from
here.
et voilà.
Here we have the Kyma Dashboard.
Let’s check if this all works Add new namespace
Give it a name You can add labels, disable side-car injection,
this concerns the Istio service mesh, we can limit total memory for the namespace, memory
per container, we will cover all this in a subsequent video,
Create Here we can add our functions,
microservices, pods, replica sets, deployments, this will be familiar to the kubernetes developer
or administrator Discovery and Network, Service Management,
the Catalog, instances, brokers, this is all specific to Kyma,
a configuration section, with secrets and config maps, again regular kubernetes objects
We can upload our YAML files or create a function using the inline editor, for example.
Looks good.
We could delete the namespace here using the Dashboard but lets do this using kubectl
Here we download the Kubeconfig file, with connection information.
A yaml file, with connection information, cluster, user, and context.
Again, just like you would connect to any kubernetes cluster, no special Kyma sauce.
Plain vanilla.
You might find that your kubectl client is a bit more recent compared to the cluster.
For production environments, you might want to make sure you have a version that matches.
For now, we are not too concerned.
kubectl get namespace (ns).
Note that there are quite a few more.
Besides the kube-system namespace, we also find a kyma-system namespace, an istio-system
namespace, and some others.
All restricted.
We can describe the test namespace, and we can also delete the namespace
and if we return then to our homepage of the Kyma dashboard, we can see that indeed the
namespace has been deleted.
What about the BTP CLI?
With the command btp list security/role adding the subaccount we can list the roles for the
subaccount Command btp list security/role-collection
does this for role collections To assign users to a role collection, we can
use the btp assign command but we already did that, so let’s first unassign the user
with command btp unassign from user adding e-mail and subacocunt
If we now return to the cockpit and refresh the page, our user is gone.
and when we then run the btp assign to user command
and return to the cockpit, refresh, the user has been added back again.
Single command, that’s all it takes.
Okay, so much for roles and role collections.
In the next video, we cover system registration.
This video tutorial was recorded by Denys van Kempen, SAP HANA Academy / SAP Partner
Innovation Lab For updates, don’t forget to subscribe.
Thanks for watching.