{"id":19974821,"url":"https://github.com/navercloudplatform/ncp-iam-authenticator","last_synced_at":"2025-10-25T01:43:27.243Z","repository":{"id":64497432,"uuid":"563711065","full_name":"NaverCloudPlatform/ncp-iam-authenticator","owner":"NaverCloudPlatform","description":"a tool for authenticating to a Kubernetes cluster with NCP IAM credentials","archived":false,"fork":false,"pushed_at":"2023-11-17T08:44:33.000Z","size":178,"stargazers_count":7,"open_issues_count":0,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-08-05T18:38:51.795Z","etag":null,"topics":["auth","iam","kubernetes","navercloudplatform","ncloud"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/NaverCloudPlatform.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2022-11-09T07:03:20.000Z","updated_at":"2024-11-06T00:06:57.000Z","dependencies_parsed_at":"2023-11-17T10:08:33.475Z","dependency_job_id":null,"html_url":"https://github.com/NaverCloudPlatform/ncp-iam-authenticator","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/NaverCloudPlatform/ncp-iam-authenticator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NaverCloudPlatform%2Fncp-iam-authenticator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NaverCloudPlatform%2Fncp-iam-authenticator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NaverCloudPlatform%2Fncp-iam-authenticator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NaverCloudPlatform%2Fncp-iam-authenticator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/NaverCloudPlatform","download_url":"https://codeload.github.com/NaverCloudPlatform/ncp-iam-authenticator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/NaverCloudPlatform%2Fncp-iam-authenticator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":280893651,"owners_count":26409279,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-24T02:00:06.418Z","response_time":73,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["auth","iam","kubernetes","navercloudplatform","ncloud"],"created_at":"2024-11-13T03:16:14.546Z","updated_at":"2025-10-25T01:43:27.210Z","avatar_url":"https://github.com/NaverCloudPlatform.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# NCP IAM Authenticator for Kubernetes\n\nNAVER Cloud Platform Kubernetes Service provides IAM authentication through `ncp-iam-authenticator`.  \nTo use the kubectl command through IAM authentication, you should install `ncp-iam-authenticator` and edit the kubectl configuration file to use it for authentication.  \nThe initial project was developed by NAVER Cloud Platform Kubernetes Service engineers, and now anyone can contribute to the project.\n## Contents\n- [Guide](#guide)\n- [Installation](#installation)\n- [Creating IAM authentication kubeconfig](#creating-iam-authentication-kubeconfig)\n    - [Set ncp-iam-authenticator API authentication key value](#set-ncp-iam-authenticator-api-authentication-key-value)\n    - [Use command ncp-iam-authenticator create-kubeconfig](#use-command-ncp-iam-authenticator-create-kubeconfig)\n- [IAM authentication user management](#iam-authentication-user-management)\n    - [Add IAM user to cluster](#add-iam-user-to-cluster)\n\n## Guide\nNAVER Cloud Platform Official Guide provides more detailed and friendly guides.\n- [PUB](https://guide.ncloud-docs.com/docs/en/k8s-iam-auth-ncp-iam-authenticator#) (Multilingual support including English)\n- [FIN](https://guide-fin.ncloud-docs.com/docs/k8s-iam-auth-ncp-iam-authenticator) (Only Korean)\n- [GOV](https://guide-gov.ncloud-docs.com/docs/k8s-iam-auth-ncp-iam-authenticator) (Only Korean)\n\n## Installation\n1. Specify version, os and arch you want to use.\n    ```bash\n    export version=\"1.0.6\" # available versions can be found in GitHub Releases.\n    export os=\"darwin\" # darwin, linux, windows\n    export arch=\"amd64\" # amd64, arm64\n    ```\n2. Download the `ncp-iam-authenticator` binary.\n    - macOS, Linux\n    ```bash\n    curl -o ncp-iam-authenticator -L https://github.com/NaverCloudPlatform/ncp-iam-authenticator/releases/download/v${version}/ncp-iam-authenticator_${os}_${arch}\n    ```\n    - windows (PowerShell)\n    ```bash\n    curl -o ncp-iam-authenticator -L https://github.com/NaverCloudPlatform/ncp-iam-authenticator/releases/download/v${version}/ncp-iam-authenticator_windows_amd64.exe\n    ```\n3. (Optional) You can use SHA-256 SUM to check the downloaded binary file.\n    1. Check the sum of SHA-256 of the `ncp-iam-authenticator` binary file.\n        - macOS, Linux\n            ```bash\n            openssl sha1 -sha256 ncp-iam-authenticator\n            ```\n        - windows (PowerShell)\n            ```bash\n            Get-FileHash ncp-iam-authenticator.exe\n            ```\n    2. Download SHA-256 SUM.\n        ```bash\n        curl -o ncp-iam-authenticator.sha256 -L https://github.com/NaverCloudPlatform/ncp-iam-authenticator/releases/download/v${version}/ncp-iam-authenticator_${version}_SHA256SUMS\n        ```\n    3. Checks if two values match.\n4. Set permission and Path\n    - macOS, Linux\n        1. Add the execution permission to the binary.\n            ```bash\n            chmod +x ./ncp-iam-authenticator\n            ```\n        2. Create `$HOME/bin/ncp-iam-authenticator`, and add to `$PATH`.\n            ```bash\n            mkdir -p $HOME/bin \u0026\u0026 cp ./ncp-iam-authenticator $HOME/bin/ncp-iam-authenticator \u0026\u0026 export PATH=$PATH:$HOME/bin\n            ```\n        3. Add `PATH` to the shell profile.\n           - bash\n               ```bash\n               echo 'export PATH=$PATH:$HOME/bin' \u003e\u003e ~/.bash_profile\n               ```\n           - zsh\n               ```bash\n               echo 'export PATH=$PATH:$HOME/bin' \u003e\u003e ~/.zshrc\n               ```\n    - windows\n        1. Create a new folder, such as C:\\bin.\n        2. Copy the execution file ncp-iam-authenticator.exe to the new folder.\n        3. Edit the user or system PATH environment variable to add the new folder to PATH.\n        4. Close the PowerShell terminal, and open a new terminal to import the new PATH variable.\n5. Test if the `ncp-iam-authenticator` binary works normally.\n    ```\n    ncp-iam-authenticator help\n    ```\n\n## Creating IAM authentication kubeconfig\n\nYou can create a kubeconfig through `ncp-iam-authenticator`, or manually create a kubeconfig that uses `ncp-iam-authenticator`, for IAM cluster authentication in Kubernetes Service.\n\n### Set ncp-iam-authenticator API authentication key value\n\nAn API authentication key value must first be set up to use `ncp-iam-authenticator`.  \nYou can get the API authentication key from **[My Page]** \u003e **[Manage account]** \u003e **[Manage authentication key]**  \nSet the API key in OS environment variable or configure file. ( OS environment variable takes priority over the configure file.)\n\n- OS environment variable\n    ```bash\n    export NCLOUD_ACCESS_KEY=ACCESSKEYACCESSKEYAC\n    export NCLOUD_SECRET_KEY=SECRETKEYSECRETKEYSECRETKEYSECRETKEYSECR\n    export NCLOUD_API_GW=https://ncloud.apigw.ntruss.com\n    ```\n- The configure file in the user environment home directory's .ncloud folder\n    ```bash\n    $ cat ~/.ncloud/configure\n    [DEFAULT]\n    ncloud_access_key_id = ACCESSKEYACCESSKEYAC\n    ncloud_secret_access_key = SECRETKEYSECRETKEYSECRETKEYSECRETKEYSECR\n    ncloud_api_url = https://ncloud.apigw.ntruss.com\n    \n    [project]\n    ncloud_access_key_id = ACCESSKEYACCESSKEYAC\n    ncloud_secret_access_key = SECRETKEYSECRETKEYSECRETKEYSECRETKEYSECR\n    ncloud_api_url = https://ncloud.apigw.ntruss.com\n    ```\n\n### Use command ncp-iam-authenticator create-kubeconfig\n1. Confirm if `ncp-iam-authenticator` has been installed.\n2. Use the `ncp-iam-authenticator create-kubeconfig` command to create a kubeconfig for the cluster.\n    ```bash\n    ncp-iam-authenticator create-kubeconfig --region \u003cregion-code\u003e --clusterUuid \u003ccluster-uuid\u003e \u003e kubeconfig.yaml\n    ```\n    - region-code : Cluster Region code\n      ex) KR, SGN\n    - cluster-uuid: Cluster UUID\n    - If you specify a profile of the NCLOUD CLI configure file with the `--profile` option, then the profile will be used for authentication when the `kubectl` command is executed.\n3. Test the `kubectl` command with the `kubeconfig` file created.\n    ```bash\n    $ kubectl get namespaces --kubeconfig kubeconfig.yaml\n    NAME                    STATUS   AGE\n    default                 Active   1h\n    kube-node-lease         Active   1h\n    kube-public             Active   1h\n    kube-system             Active   1h\n    kubernetes-dashboard    Active   1h\n    ```\n\n## IAM authentication user management\nWhen you create a Kubernetes Service cluster, the `SubAccount account that created the cluster` and `main account` will automatically be included in the `system:masters` group in the cluster's RBAC configuration. This configuration is not shown in the cluster information or ConfigMap. In order to give permissions to use a cluster to an IAM user, `ncp-auth` ConfigMap must be registered to the `kube-system` namespace.  \nThe configuration can be set up after `ncp-iam-authenticator` has been installed and the kubeconfig is created.\n\n### Add IAM user to cluster\n1. A `kubectl` credential must already be set up with the `IAM user who created the cluster` or `main account`.\n2. Create `ncp-auth` ConfigMap.\n    ```\n    apiVersion: v1\n    kind: ConfigMap\n    metadata:\n      name: ncp-auth\n      namespace: kube-system\n    data:\n      mapSubAccounts: |\n        - subAccountIdNo: \u003ciam-user-idno\u003e\n          username: \u003cusername\u003e\n          groups:\n            - \u003cgroups\u003e\n    ```\n3. ConfigMap's IAM user parameters are as below.\n    - subaccountIdNo: ID number of the IAM user to be added, as can be confirmed from the IAM console\n    - username: username to map on the IAM user within Kubernetes\n    - groups: list of groups to map users within Kubernetes For more details, refer to [Default roles and role bindings](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings).\n4. Check if the IAM user, or the Kubernetes user or user group with a role mapped, is bound to a Kubernetes role by `RoleBinding` or `ClusterRoleBinding`. For more information, refer to [Using RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) in the Kubernetes documents.\n- Permission to view resources in all namespaces - The group name is `full-access-group`, and this needs to be mapped to the IAM user groups from `ncp-auth` ConfigMap.\n    ```bash\n    $ cat \u003c\u003cEOF | kubectl --kubeconfig $KUBE_CONFIG apply -f -\n    apiVersion: rbac.authorization.k8s.io/v1\n    kind: ClusterRole\n    metadata:\n     name: full-access-clusterrole\n    rules:\n    - apiGroups:\n      - \"\"\n      resources:\n      - nodes\n      - namespaces\n      - pods\n      verbs:\n      - get\n      - list\n    - apiGroups:\n      - apps\n      resources:\n      - deployments\n      - daemonsets\n      - statefulsets\n      - replicasets\n      verbs:\n      - get\n      - list\n    - apiGroups:\n      - batch\n      resources:\n      - jobs\n      verbs:\n      - get\n      - list\n    ---\n    apiVersion: rbac.authorization.k8s.io/v1\n    kind: ClusterRoleBinding\n    metadata:\n    name: full-access-binding\n    subjects:\n    - kind: Group\n     name: full-access-group\n     apiGroup: rbac.authorization.k8s.io\n    roleRef:\n     kind: ClusterRole\n     name: full-access-clusterrole\n     apiGroup: rbac.authorization.k8s.io\n    EOF\n    ```\n\n- Permission to view resources for a specific namespace - The namespace set to the file is `default`, so please specify the namespace you want and modify the result. The group name is `restricted-access-group`, and this needs to be set to IAM user's groups in the `ncp-auth` ConfigMap.\n    ```\n    $ cat \u003c\u003cEOF | kubectl --kubeconfig $KUBE_CONFIG apply -f -\n    apiVersion: rbac.authorization.k8s.io/v1\n    kind: ClusterRole\n    metadata:\n      name: restricted-access-clusterrole\n    rules:\n    - apiGroups:\n      - \"\"\n      resources:\n      - nodes\n      - namespaces\n      verbs:\n      - get\n      - list\n    ---\n    apiVersion: rbac.authorization.k8s.io/v1\n    kind: ClusterRoleBinding\n    metadata:\n      name: restricted-access-clusterrole-binding\n    subjects:\n    - kind: Group\n      name: restricted-access-group\n      apiGroup: rbac.authorization.k8s.io\n    roleRef:\n      kind: ClusterRole\n      name: restricted-access-clusterrole\n      apiGroup: rbac.authorization.k8s.io\n    ---\n    apiVersion: rbac.authorization.k8s.io/v1\n    kind: Role\n    metadata:\n      namespace: default\n      name: restricted-access-role\n    rules:\n    - apiGroups:\n      - \"\"\n      resources:\n      - pods\n      verbs:\n      - get\n      - list\n    - apiGroups:\n      - apps\n      resources:\n      - deployments\n      - daemonsets\n      - statefulsets\n      - replicasets\n      verbs:\n      - get\n      - list\n    - apiGroups:\n      - batch\n      resources:\n      - jobs\n      verbs:\n      - get\n      - list\n    ---\n    apiVersion: rbac.authorization.k8s.io/v1\n    kind: RoleBinding\n    metadata:\n      name: restricted-access-role-binding\n      namespace: default\n    subjects:\n    - kind: Group\n      name: restricted-access-group\n      apiGroup: rbac.authorization.k8s.io\n    roleRef:\n      kind: Role\n      name: restricted-access-role\n      apiGroup: rbac.authorization.k8s.io\n    EOF\n    ```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnavercloudplatform%2Fncp-iam-authenticator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnavercloudplatform%2Fncp-iam-authenticator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnavercloudplatform%2Fncp-iam-authenticator/lists"}