Templates For Cluster Accounts

Account Templates are a way to automatically create an account in a connected cluster for a new team or user and optionally create other resources that belong to such an account.

Since cluster access is determined in Loft by who has an account in which cluster, creating an account in a cluster is equivalent of giving a user access to a cluster. Account templates are particularly useful when using single sign-on because users are being created when they log in for the first time and without any cluster accounts, a new user will not automatically be able to do anything. Account templates can solve this by automatically creating accounts for such users.

A cluster account template is a Custom Resource in Kubernetes and consists of 3 components:

  1. Cluster Selector: A label selector to select clusters to define in which clusters a new account will be created.
  2. Account Template: An account template that specifies how the created account should look like.
  3. Templates For Additional Account Resources: An array of owned resources (e.g. AccountQuota, ClusterRoleBinding etc.), which the account owns and an owner reference to the account is set to. This has the advantage that if the account is deleted, all of its owned resources are deleted as well and ownership of resources can be easily identified.

Create Account Templates

You can create cluster account templates either via kubectl or the Loft UI.

Navigate to the Account Templates section under Users and press Add Cluster Account Template.

Create a new Cluster Account Template
Create a new Cluster Account Template

You will be presented with several options how the Cluster Account Template can be configured:

Create a new Cluster Account Template
Create a new Cluster Account Template

At first, you can optionally specify the Kubernetes Metadata of Cluster Account Template such as annotations or labels for this Account Template object.

Then, you can specify what the account template should do:

  1. Select Clusters: Labels in the form of label1=value1 that specify which clusters an account should be created in. If empty, all clusters are selected. You will see which clusters are selected in the account templates table under the column 'Selected Clusters'
  2. Create Account in Clusters: Account settings for the account that will be created in the cluster. This section is very similar to the Space Creation Settings section in the Clusters -> Accounts drawer.
  3. Create Account Resources in Clusters:
    • Account Quota: Here, you can define the hard limits for an account quota that will be created for the account. Leave empty to create no AccountQuota for the account.
    • Cluster Role Bindings: For each of these cluster roles, a ClusterRoleBinding is created for the account. Use this, for example, if you want to grant a user full cluster access.
    • Other Resources: Other custom Kubernetes resources that should be created in the target cluster for the account. This can be any Kubernetes resource yaml. Bear in mind that:
      • No metadata section required: Loft will automatically set metadata.generateName if no metadata for a resource is provided
      • You can use ${LOFT_ACCOUNT_NAME} as a placeholder for the account name. For example, in an AccountQuota you can set spec.account: ${LOFT_ACCOUNT_NAME}. This will be replaced by the correct account name when the account is actually created.
      • An ownerReference will be set automatically for the resource that references the account. This means that deleting the account will also delete all its resources.

After you are done configuring the ClusterAccountTemplate, press Create to create the resource. This will not create any accounts yet.

Use Account Templates

Applying cluster account templates to an user or team can be done either via kubectl or the Loft UI. For automatically applying account templates to users on single sign-on, please see the next section.

Apply Cluster Account Templates
Apply Cluster Account Templates

In the Account Templates section, you are able to select one or multiple cluster account templates to apply to a user or team when creating or editing it.

Preselect Account Templates

Some account templates might be preselected, these are the templates that have the label loft.sh/default-template: "true" specified.

How Templates are applied

The account templates will be applied in the order that they are specified, if multiple account templates target the same cluster, only ONE account is created for the cluster and templates are skipped for a cluster if an account for that user or team does already exist. If an error during applying the account templates is encountered, the error message can be viewed in the Status column of the user or team.

Reapply Templates

If you want to reapply a template for an user or team, delete it and then re-add it to the user or team. This will NOT delete accounts and only works for templates that have failed to apply. If you want to delete a template and the corresponding account resources, please delete the account of the user in the cluster instead. This will delete ALL spaces and resources the account owns in the cluster.

For Single Sign-On (SSO)

If you configured single sign-on, you may want to give users access to certain clusters when they sign in for the first time, potentially depending on their groups.

To tell Loft to automatically apply certain account templates to new users when they sign in via SSO for the first time, navigate to Admin > Config in Loft and add the following lines to your auth.oidc section of the config:

issuerUrl: 'https://my.issuer.com/'
clientId: CLIENT_ID
clientSecret: CLIENT_SECRET
groupsClaim: groups
getUserInfo: true
clusterAccountTemplates: # Apply these templates to every new user
- name: loft-all-clusters-default # Name of template 1
- name: some-other-account-template # Name of template 2
groupClusterAccountTemplates: # Apply templates depending on the user's groups
- group: admin-group: # Apply if user has group `admin-group`
- name: loft-all-clusters-admin # Name of the account template to apply
Configure Automatic Cluster Account Templates
Configure Automatic Cluster Account Templates