manage-access

Map user groups to project roles using OrganizationGroup resources.

34|5|Updated Mar 5, 2025

Search Tags:#rbac #keycloak #access-control #ui-management #kube-dc #organization-group #project-permissions

Ready to run

npx skills add https://github.com/kube-dc/kube-dc-public --skill manage-access

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: manage-access
Source: https://github.com/kube-dc/kube-dc-public/tree/main/skills/manage-access
Command: npx skills add https://github.com/kube-dc/kube-dc-public --skill manage-access

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Organizations need a scalable way to control who can access which Kubernetes projects and what actions they can perform, without managing individual user accounts in Kubernetes directly.

Core Features & Use Cases

Create OrganizationGroup resources to map user groups to project roles.
Enforce per-project RBAC across multiple projects within an organization.
UI-based user management via Keycloak; no per-user Kubernetes credentials; RoleBindings are created automatically.

Quick Start

Create an OrganizationGroup named 'dev-team' in organization 'org1' mapping the 'developer' role to project 'project-a' and the 'admin' role to project 'project-b'.

Frequently Asked Questions about manage-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I map Keycloak user groups to Kubernetes RBAC roles across multiple projects?▼

To map Keycloak user groups to Kubernetes RBAC, create OrganizationGroup resources that link your groups to specific project roles. This automatically provisions the necessary RoleBindings in each project namespace without manual per-user credential management.

How do I automatically provision access and onboard users across multiple Kubernetes projects?▼

You can provision access and onboard users across multiple projects by defining OrganizationGroup resources. This automatically reconciles RoleBindings in each project namespace, applying the specified role mappings organization-wide.

What is the best way to manage multi-project RBAC without creating individual Kubernetes credentials?▼

The best way to manage multi-project RBAC without individual Kubernetes credentials is using UI-based user management via Keycloak. OrganizationGroup resources map these user groups to project roles, enforcing access control automatically.

Can I assign different RBAC roles to the same user group across different projects?▼

Yes, you can assign different RBAC roles to the same user group across multiple projects. By configuring a single OrganizationGroup, you can map a Keycloak group to a developer role in one project and an admin role in another.

How does RoleBinding reconciliation work when updating project permissions in a multi-project organization?▼

RoleBinding reconciliation works by automatically creating and updating bindings in each project namespace whenever you change an OrganizationGroup. This ensures your desired project permissions and role mappings are consistently enforced across the organization.