Custom ZTKA Access

Important

This capability is currently available with self-hosted controller and in Preview Orgs for SaaS controller.

---

The RCTL utility provides the means to manage/automate the lifecycle of OPA Gatekeeper. The following operations can be performed on OPA Gatekeeper for projects within an organization.

Resource	Create	Get	Apply	Update	Delete
Custom ZTKA rule	YES	YES	YES	YES	YES
Custom ZTKA policy	YES	YES	YES	YES	YES
Custom Role	YES	YES	YES	YES	YES

---

ZTKA Custom Access implementation involves the following three steps:

• Step 1 - Create Rules: ClusterRole or Role YAML definition files are provided as part of this step, applicability of the rule is determined based on project/cluster selection

• Step 2 - Create Policies: Policies is a collection of one or more rules that is referenced as part of Custom Roles

• Step 3 - Custom Roles: A Custom Role configuration includes selection of a base role along with the necessary overlay ZTKA Custom Access policies

---

Create Custom ZTKA rule

Run the below command to create a custom ZTKA rule using the spec yaml file.

./rctl apply -f rule_filename.yaml

An illustrative example of the spec YAML file (Artifact upload) is shown below:

apiVersion: system.k8smgmt.io/v3
kind: ZTKARule
metadata:
  name: rctl-rule-all1
spec:
  artifact:
    artifact:
      paths:
        - name: file://artifacts/ztkar.yaml
    options: {}
    type: Yaml
  clusterSelector:
    selectAll: true
  projectSelector:
    matchNames:
      - z-1
      - defaultproject
  version: v1

An illustrative example of the spec YAML file (Git Repo based) is shown below:

apiVersion: system.k8smgmt.io/v3
kind: ZTKARule
metadata:
  name: rctl-rule-all1
spec:
  artifact:
    artifact:
      paths:
        - name: path/to/ztkarule/file.yaml
      project: defaultproject #project in which repo is present
      repository: some-repo
      revision: master
    options: {}
    type: Yaml
  clusterSelector:
    selectAll: true
  projectSelector:
    matchNames:
      - z-1
      - defaultproject
  version: v1

---

Create Custom ZTKA policy

An illustrative example of the ZTKA Policy spec YAML file is as shown below:

apiVersion: system.k8smgmt.io/v3
kind: ZTKAPolicy
metadata:
  name: rctl-pol-all1
spec:
  version: v1
  ztkaRuleList:
    - name: rctl-rule-all1
      version: v1
    - name: rctl-rule-all2
      version: v2

---

Create Custom Role

An illustrative example of the Custom Role spec YAML file is as shown below:

apiVersion: system.k8smgmt.io/v3
kind: CustomRole
metadata:
  name: rctl-ctr-all1
spec:
  baseRole: ADMIN
  ztkaPolicyList:
    - name: rctl-pol1
      version: v1

---

List ZTKA Rules

Use this command to retrieve the list of ZTKA rules. An illustrative example is shown below where RCTL retrieves the list of ZTKA rules.

./rctl get ztkarule
+---------------------------+---------------------------+---------------+-------------------------------------------------------+------------------------+
| ZTKARULE NAME             | VERSION                   | ARTIFACT TYPE | ARTIFACT FILES                                        | REPOSITORY             |
+---------------------------+---------------------------+---------------+-------------------------------------------------------+------------------------+
| test-rctl-1              | v1                        | Yaml          | paths:{name:"file:///artifacts/ztkar_podreader.yaml"} |                        |
+---------------------------+---------------------------+---------------+-------------------------------------------------------+------------------------+
| test-rctl-2              | v1                        | Yaml          | paths:{name:"file://artifacts/ztkacr.yaml"}           |                        |
+---------------------------+---------------------------+---------------+-------------------------------------------------------+------------------------+

Get Specific ZTKA Rule

Below is an example to retrieve a specific ZTKA rule.

./rctl get ztkarule test-rule
+---------------+---------+---------------+----------------------------------------------------+------------+
| ZTKARULE NAME | VERSION | ARTIFACT TYPE | ARTIFACT FILES                                     | REPOSITORY |
+---------------+---------+---------------+----------------------------------------------------+------------+
| test-rule     | v1      | Yaml          | paths:{name:"file://nginx_ns_pod_read_write.yaml"} |            |
+---------------+---------+---------------+----------------------------------------------------+------------+

---

List ZTKA Policies

Use this command to retrieve the list of ZTKA policies. An illustrative example is shown below where RCTL retrieves the list of ZTKA policies.

./rctl get ztkapolicy
+--------------------+---------------------------+---------------------------+
| ZTKAPOLICY NAME    | VERSION                   | RULES                     |
+--------------------+---------------------------+---------------------------+
| test-rctl-1        | v1                        | test-rctl-1              |
|                    |                           | test-rctl-2              |
|                    |                           |                           |
+--------------------+---------------------------+---------------------------+
| test-secret-pod1   | v1                        | test-secret-cr1          |
|                    |                           | test-podreader1          |
|                    |                           |                           |
+--------------------+---------------------------+---------------------------+
| test-1             | ver1                      | test-rule1                |
|                    |                           |                           |
+--------------------+---------------------------+---------------------------+
| test-ztka-policy   | v1                        | test-swagger             |
|                    |                           | test-rctl-2              |
+--------------------+---------------------------+---------------------------+

Get Specific ZTKA Policy

Below is an example to retrieve a specific ZTKA policy.

./rctl get ztkapolicy test-policy
+-----------------+---------+-----------+
| ZTKAPOLICY NAME | VERSION | RULES     |
+-----------------+---------+-----------+
| test-policy     | v1      | test-rule |
|                 |         |           |
+-----------------+---------+-----------+

---

List Custom Roles

Use this command to retrieve the list of Custom Roles.

./rctl get customroles
+-------------------------+-----------------+--------------------+
| CUSTOM ROLE             | ABAC POLICY     | ZTKA POLICY        |
+-------------------------+-----------------+--------------------+
| test-role1              | test-policy1    |                    |
|                         |                 |                    |
+-------------------------+-----------------+--------------------+
| test-eks-role           | test-eks-policy |                    |
|                         |                 |                    |
+-------------------------+-----------------+--------------------+
| test-role               | test-policy     |                    |
|                         |                 |                    |
+-------------------------+-----------------+--------------------+

Get Specific Custom Role

Below is an example to retrieve a specific Custom Role.

./rctl get customrole test-role
+-------------+-------------+-------------+
| CUSTOM ROLE | ABAC POLICY | ZTKA POLICY |
+-------------+-------------+-------------+
| test-role   |             | test-policy |
|             |             |             |
+-------------+-------------+-------------+

---

Delete Commands

You can use the below commands to delete ZTKA rules, ZTKA policies and Custom Roles.

ZTKA Rules

./rctl delete zr <rule-name>

OR

./rctl delete zr -f <rule_file.yaml>

ZTKA Policies

./rctl delete zp <policy-name>

OR

./rctl delete zr -f <policy_file.yaml>

Custom Roles

./rctl delete ctr <custom-role-name>

OR

./rctl delete ctr -f <custom_role_file.yaml>

---