Console and auth
This content is for 0.1.0. Switch to the latest version for up-to-date documentation.
fleet-console-auth gates DCM and fleet-site APIs, supplies console sessions,
and owns console.umkim.com/v1alpha1 RBAC resources. It is an experimental
access-control component, not a certified identity or authorization service.
The release maps directory groups to fleet roles:
| Group | Fleet role |
|---|---|
fleet-admins |
dc-admin |
fleet-site-admins |
site-admin |
fleet-cluster-admins |
cluster-admin |
fleet-org-admins |
org-admin (bind with Org/{slug} scope) |
fleet-customers |
customer (bind with Org/{slug} scope) |
Use ordinary least-privileged accounts and maintain emergency access credentials in your own protected operating procedure. Do not disclose them in source control or documentation.
Clients authenticate to the proxy; they must not forge
X-Fleet-Subject-* identity headers. Those headers are trusted assertions
inserted only by the auth proxy for downstream fleet-site authorization.