Locked-down cluster
Aspects of the invention include a computer-implemented method including providing, by a processor, a computing cluster having a plurality of cluster nodes and services. The method provides, by the processor, a limited catalog of services and restricts, by the processor, access of an administrator of the computing cluster to use of a service deployer, wherein the service deployer restricts administrator access to installation and administration of clusters and deployment of only the limited catalog of services.
1. A computer-implemented method comprising:
providing, by a processor, a computing cluster having a plurality of cluster nodes and services, wherein the computing cluster is deployed on a secure service container;
providing, by the processor, a limited catalog of services;
restricting, by the processor, access of an administrator of the computing cluster to use of a service deployer which runs as a container component on the secure service container, wherein the service deployer restricts administrator access to installation and administration of only the limited catalog of services and prevents the administrator from logging into nodes on the secure service container other than the service deployer;
exposing, by the processor, a limited set of REST API's that allow a user to view cluster-wide resources and to perform basic administrative functions including creating namespaces and adding users to a namespace, wherein the user is not an administrator.
2. The computer-implemented method of claim 1 , comprising setting-up clusters, by the processor, in an automated fashion based on user specified configurations.
3. The computer-implemented method of claim 1 , comprising enforcing strict security policies, by the processor, on the cluster to prevent administrator cluster-wide access to the cluster.
4. The computer-implemented method of claim 1 , comprising creating, by the processor, user roles and exposing the user roles to the administrator.
5. The computer-implemented method of claim 1 , comprising maintaining, by the processor, cluster administrator credentials that are abstracted from a user.
6. A system comprising:
a memory having computer readable instructions; and
one or more processors for executing the computer readable instructions, the computer readable instructions controlling the one or more processors to perform operations comprising:
providing, by the processor, a computing cluster having a plurality of cluster nodes and services, wherein the computing cluster is deployed on a secure service container;
providing, by the processor, a limited catalog of services;
restricting, by the processor, access of an administrator of the computing cluster to use of a service deployer, wherein the service deployer restricts administrator access to installation and administration of only the limited catalog of services and prevents the administrator from logging into nodes on the secure service container other than the service deployer;
exposing, by the processor, a limited set of REST API's that allow a user to view cluster-wide resources and to perform basic administrative functions including creating namespaces and adding users to a namespace, wherein the user is not an administrator.
7. The system of claim 6 , wherein the service deployer sets up clusters in an automated fashion based on user specified configurations.
8. The system of claim 6 , wherein the service deployer enforces strict security policies on the cluster to prevent administrator cluster-wide access to the cluster.
9. The system of claim 6 , wherein the service deployer creates user roles and exposes the user roles to the administrator.
10. The system of claim 6 , wherein the secure deployer maintains cluster administrator credential that are abstracted from a user.
11. A computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to perform operations comprising:
providing, by the processor, a computing cluster having a plurality of cluster nodes and services, wherein the computing cluster is deployed on a secure service container;
providing, by the processor, a limited catalog of services;
restricting, by the processor, access of an administrator of the computing cluster to use of a service deployer, wherein the service deployer restricts administrator access to installation and administration of only the limited catalog of services and prevents the administrator from logging into nodes on the secure service container other than the service deployer;
exposing, by the processor, a limited set of REST API's that allow a user to view cluster-wide resources and to perform basic administrative functions including creating namespaces and adding users to a namespace, wherein the user is not an administrator.
12. The computer program product of claim 11 , wherein the service deployer sets up clusters in an automated fashion based on user specified configurations.
13. The computer program product of claim 11 , wherein the service deployer enforces strict security policies on the cluster to prevent administrator cluster-wide access to the cluster.
14. The computer program product of claim 11 , wherein the service deployer creates user roles and exposes the user roles to the administrator.
15. The computer program product of claim 11 , wherein the secure deployer maintains cluster administrator credential that are abstracted from a user.