Identity and Access
This page explains how authentication, authorization, and quotas work in PaaS Cloud.
Authentication
Access to PaaS Cloud is federated through MetaCentrum. Users log into the dashboard via institutional identity providers or federated AAI services.
- Primary login: https://chloe.platform.cloud.e-infra.cz/
- Prerequisite: Active membership in MetaCentrum. Register or renew at https://metavo.metacentrum.cz/cs/application/index.html
If your institutional login is not available, alternative federated providers may be offered depending on the platform configuration.
Tenants and Projects
PaaS Cloud is multi-tenant. A user can be a member of one or more tenants.
- Tenant — A bounded Kubernetes namespace/workspace that contains applications, VMs, networking, and storage.
- Tenant Members — Users assigned to a tenant with specific Kubernetes Roles and RoleBindings.
Roles
Tenant roles map to Kubernetes RBAC resources (Role / RoleBinding):
| Group | Permissions |
|---|---|
| tenant-abc-view | Read-only access to Cozystack API resources; ability to view logs |
| tenant-abc-use | All view permissions + VNC access for virtual machines |
| tenant-abc-admin | All use permissions + delete pods + create/update/delete most Cozystack API resources (excludes tenant, monitoring, etcd, ingress) |
| tenant-abc-super-admin | All admin permissions + create/update/delete tenant, monitoring, etcd, and ingress |
Resource Quotas
Each tenant is bound by quotas that limit total consumption:
| Field | Description |
|---|---|
| cpu | Total CPU limits; requests.cpu is derived via cpu-allocation-ratio (default 10 on our cluster) |
| memory | Total memory |
| storage | Total persistent storage across all PVCs |
| pods | Maximum number of pods |
| services | Maximum number of services |
| services.loadbalancers | Maximum number of LoadBalancer services |
| services.nodeports | Maximum number of NodePort services |
| persistentvolumeclaims | Maximum number of PVCs |
| configmaps | Maximum number of ConfigMaps |
| secrets | Maximum number of Secrets |
Note on cpu-allocation-ratio
On our cluster the ratio is 10. Setting cpu: "4" results in limits.cpu: 4 and requests.cpu: 400m. Pods deployed in the tenant must respect the same ratio. See the quota enforcement guide for details.
To request a quota increase, contact the cloud team with a description of your use case and expected growth.
Service Accounts and API Access
Advanced users and automation pipelines can interact with the platform API using tokens:
- Service accounts can be created within a tenant.
- Tokens are used for programmatic access (e.g., CI/CD pipelines, external automation).
- Tokens should be treated as secrets and rotated regularly.
kubectl and kubeconfig Access
For interactive command-line access to a tenant namespace, PaaS Cloud provides an OIDC-based kubeconfig. Authentication is handled through the platform Keycloak instance using the kubectl oidc-login plugin (kubelogin).
With a tenant kubeconfig you can:
- Manage
vm-diskandvm-instanceresources directly. - Inspect application packages and their parameters.
- Use
virtctlfor VM operations.
Note
Service-account tokens are still the preferred choice for CI/CD pipelines and other non-interactive automation.
Known Issue: Wrong OIDC Issuer URL
Tenant kubeconfigs generated by Cozystack v1.4 currently contain an incorrect OIDC issuer URL:
- Generated (wrong):
https://keycloak.cloud.chloe.platform.cloud.e-infra.cz/realms/cozy - Correct:
https://keycloak.chloe.platform.cloud.e-infra.cz/realms/cozy
The info Helm chart uses the per-tenant _namespace.host value when building the Keycloak URL, but Keycloak is a shared platform service reachable only at the root host. This must be corrected after every kubeconfig download.
For the full setup instructions and the workaround, see Using kubectl.
