Search code examples
kubernetesopenshift-originrbac

Is Kubernernetes' RBAC the same as OpenShift's access control?


Since Kubernetes release 1.6 until RBAC's GA in 1.8 there has been a lot of background noise about how RBAC is now the default in Kubernetes and is a complete rehaul of the permissions framework. As an OpenShift Origin user/administrator, I haven't been following the Kubernetes side of the discussion, reasoning that I'd wait for a proper OpenShift Origin release including those changes and then look up the release notes and/or migration documentation.

However, now that I've skimmed through a couple of articles about RBAC, I have found the descriptions of RBAC extremely similar to OpenShift's permissions framework (being in use since Origin's inception), to the point of being minorly different in syntax only.

So is my impression correct that Kubernetes' RBAC is just an upstream port or direct code donation from OpenShift Origin, with only minor changes?


Solution

  • Yes, it was an upstream port of OpenShift's access control, with minor differences. Over the 3.6 and 3.7 releases, OpenShift is migrating to back its authorization objects with Kubernetes objects:

    • In OpenShift 3.6, OpenShift authorization objects migrate to corresponding Kubernetes RBAC objects, overwriting any existing Kubernetes RBAC objects
    • In OpenShift 3.7, the Kubernetes RBAC objects back both the OpenShift and Kubernetes APIs, and either can be used interchangeably