ServerMind for Kubernetes/Identity & Access

Identity & Access

Federate sign-in to OpenID Connect, SAML 2.0 or LDAP, with TOTP or passkey MFA enforced on every door. Roles, just-in-time grants, break-glass and optional Kubernetes impersonation decide who may change which cluster.

OIDC · SAML · LDAP

Sign-in Methods

OpenID ConnectPKCE sign-in with endpoints discovered from the issuer. Entra, Okta, Keycloak, Google and GitLab through one form, with RP-Initiated Logout that also ends the provider session.
SAML 2.0Paste the IdP metadata XML or enter entity ID, SSO URL and signing certificate. SP-initiated login and single logout.
LDAP / ADldaps:// with a bind DN and user search base; plaintext LDAP is refused unless explicitly allowed. Groups from memberOf.
PasskeysPasswordless WebAuthn sign-in, and a passkey also works as a second factor.
Email codeOne-time sign-in code to a verified address when an SMTP channel is configured; never offered to accounts with MFA.
SCIM 2.0User provisioning and deprovisioning from Okta or Entra, with every applied operation kept in an event log.
  • IdP client secrets and bind passwords live in Kubernetes Secrets, never in the database, and are never shown again after saving
  • Callback, ACS and logout URLs shown copy-ready from the console address, so there is nothing to hand-assemble
  • Per-provider access policy: target tenant, default role on first sign-in, group-to-role mappings and an allowed-groups list
  • Upstream group names are namespaced, so an IdP group called admins cannot grant platform administration
  • Federated users are matched by provider and external id, never by email
  • Issuers on private, loopback or in-cluster addresses are refused unless the owner allows that provider explicitly

MFA & Sessions

  • TOTP or passkey asked on every sign-in door: local, LDAP, OIDC and SAML
  • Ten single-use recovery codes, stored with Argon2id
  • Adding or removing a factor requires a sign-in from the last 5 minutes, and sends a notice to the account mailbox
  • Guess limits: 5 per challenge and 10 failures per user in 15 minutes
  • Session list with revoke-one and sign out everywhere else
  • Access tokens last 15 minutes and sessions 8 hours by default; the refresh cookie is httpOnly, Secure and SameSite=Strict

Roles & Elevated Access

Roles & Groups

Writer roles (admin, cluster-admin, editor, edit, owner) may change a cluster; every other role is read-only. Grants apply at fleet, tenant or single-cluster scope, and a group grant covers every member.

Just-in-Time Access

Users request a role; a second admin approves it. Grants expire automatically within at most 30 days, you cannot approve your own request, and each person can hold up to 5 pending requests.

Break-Glass

Immediate admin access for emergencies, written to the hash-chained audit log and sealed automatically after 60 minutes.

Fleet RBAC

Define a Kubernetes grant once on the hub and it lands on every target cluster as a ClusterRole plus bindings, reconciled and revoked everywhere on delete.

API Tokens

Per-user tokens for the CLI and CI, shown once and stored only as a SHA-256 hash. A token acts as its owner, can be set to expire, and is pinned to the platform scope its owner held when it was minted.

Kubernetes Impersonation

Optional: console requests reach each cluster as the signed-in user plus mapped groups, so native RBAC decides. system: groups are dropped, and an identity that cannot be expressed fails closed instead of running as the agent.

Tenancy & Isolation

  • Tenant always taken from the verified token, and enforced again by PostgreSQL row-level security in deny-by-default mode
  • Three separate authorities: cluster roles, tenant administration and installation administration
  • Pod Security Admission levels set per namespace, with enforce, warn and audit chosen independently
  • Raw writes of Pod Security or tenant labels are admin-only, so a tenant editor cannot open privileged pods or forge membership
  • One-click namespace isolation: default-deny ingress plus allow-same-namespace, and a form-based NetworkPolicy editor with live YAML preview
  • In-cluster projects group namespaces under one label, with quota, Pod Security and ingress isolation applied to every member; platform namespaces are skipped
← Compliance & AuditObservability & Alerting →