RBAC (Role-Based Access Control)

PiVirt uses Role-Based Access Control (RBAC) to enforce least-privilege security across organizations, namespaces, and virtual machine resources.

RBAC Model

Roles

Role	Permissions	Use Case
admin	Full access to all resources	Cluster administrators
operator	Create, read, update resources (no delete)	Day-to-day operations
viewer	Read-only access	Monitoring, auditing
vm-owner	Access to own VMs only	End users

Scopes

• Cluster: Access to all namespaces
• Namespace: Access to specific namespace
• Resource: Access to specific resource

RBAC Configuration

Policy File

/etc/pivirt-agent/rbac.yaml

apiVersion: rbac.pivirt.pilab.hu/v1
kind: Policy
rules:
  # Admin full access
  - roles: ["admin"]
    resources: ["*"]
    verbs: ["*"]

  # Operator: VM lifecycle, no delete
  - roles: ["operator"]
    resources: ["virtualmachines", "volumes", "networks"]
    verbs: ["get", "list", "create", "update", "patch"]

  # Viewer: Read-only
  - roles: ["viewer"]
    resources: ["*"]
    verbs: ["get", "list"]

  # VM Owner: Own VMs only
  - roles: ["vm-owner"]
    resources: ["virtualmachines"]
    verbs: ["get", "list", "update", "patch", "start", "stop", "console"]
    conditions:
      - field: "metadata.owner"
        operator: "Equals"
        value: "{{.user.identity}}"

Role Bindings

apiVersion: rbac.pivirt.pilab.hu/v1
kind: RoleBinding
metadata:
  name: admin-binding
  namespace: production
subjects:
  - kind: User
    name: "admin@pilab.hu"
  - kind: Group
    name: "platform-team"
roleRef:
  kind: ClusterRole
  name: "admin"

apiVersion: rbac.pivirt.pilab.hu/v1
kind: RoleBinding
metadata:
  name: operator-binding
  namespace: production
subjects:
  - kind: User
    name: "operator@pilab.hu"
roleRef:
  kind: Role
  name: "operator"

Resources & Verbs

Resources

Resource	Description
virtualmachines	VM lifecycle operations
volumes	Storage volume management
networks	Network configuration
snapshots	VM and volume snapshots
clusters	Cluster management
nodes	Node management
namespaces	Namespace management
serviceaccounts	Service account management
roles	Role definitions
rolebindings	Role bindings

Verbs

Verb	Description
get	Read single resource
list	List multiple resources
create	Create new resource
update	Update existing resource
patch	Partially update resource
delete	Delete resource
watch	Watch for changes
start	Start VM
stop	Stop VM
console	Access VM console

Conditions

Attribute-Based Conditions

conditions:
  - field: "metadata.namespace"
    operator: "Equals"
    value: "production"

  - field: "metadata.labels.env"
    operator: "In"
    values: ["prod", "staging"]

  - field: "spec.cpu.cores"
    operator: "LessThan"
    value: "8"

Time-Based Conditions

conditions:
  - type: "time"
    operator: "Between"
    values: ["09:00", "17:00"]
    timezone: "Europe/Budapest"

IP-Based Conditions

conditions:
  - type: "source_ip"
    operator: "In"
    values: ["10.0.0.0/8", "192.168.0.0/16"]

User Management

Create User

# Create user with OIDC
pvcli auth user create \
  --email "user@pilab.hu" \
  --roles "operator" \
  --namespace "production"

Assign Role

# Assign role to user
pvcli auth rolebinding create \
  --user "user@pilab.hu" \
  --role "operator" \
  --namespace "production"

List Permissions

# Check user permissions
pvcli auth permissions --user "user@pilab.hu" --namespace "production"

# Check current user permissions
pvcli auth permissions

Service Accounts

Create Service Account

apiVersion: pivirt.pilab.hu/v1
kind: ServiceAccount
metadata:
  name: ci-pipeline
  namespace: production
spec:
  roles:
    - "operator"
  token_ttl: "30d"

Use Service Account

# Generate API key
pvcli auth apikey create \
  --service-account "ci-pipeline" \
  --namespace "production"

# Use API key
export PIVIRT_API_KEY="pivirt_apikey_..."
pvcli vm list

Troubleshooting

Permission Denied

# Check user roles
pvcli auth user get "user@pilab.hu" -o yaml

# Check role bindings
pvcli auth rolebinding list --namespace "production"

# Check policy
cat /etc/pivirt-agent/rbac.yaml

Common Issues

Issue	Resolution
Permission denied	Check role bindings, verify RBAC policy
Cannot access namespace	Check namespace role binding
Cannot delete resource	Check if role has delete permission
Service account expired	Regenerate API key

Related

• Security Overview
• Authentication
• TLS/mTLS