Skip to main content
Version: latest

Validate-Auth

The Palette CLI has built-in support for the open source Validator framework and its plugins ecosystem. You can use the Palette CLI to verify you have the necessary permissions to deploy Kubernetes clusters in your targeted environment through Palette.

Limitations​

  • AWS and Azure are the only supported cloud environments.

Prerequisites​

  • If validating permissions for an AWS environment, ensure you have the minimal AWS-managed permission policies required to perform the validation. Refer to Minimal AWS managed IAM permission policies by validation type for guidance.

    • You will need to provide the following details during the validation steps:

      • Access Key ID for the IAM user that will perform the validation.
      • Secret Access Key for the IAM user that will perform the validation.
      • The IAM user name or IAM role name that will be deploying clusters in your environment.

  • If validating permissions for an Azure environment, ensure you have the minimal Azure Role-Based Access Control (RBAC) permissions required to perform the validation. Refer to Minimal Azure RBAC permissions by validation type for guidance.

    • You will need to provide the following details during the validation steps:

      • Microsoft Entra tenant ID for your Azure subscription where the service principal performing the validation resides.
      • Client ID for the service principal that will perform the validation.
      • Client secret associated with the service principal that will perform the validation.
      • Service Principal ID for the service principal that will be deploying clusters in your environment.
      • Subscription ID for where the clusters will be deployed to.
      • Name of the resource group where the clusters will be deployed to.

Usage​

Use the validate-auth command to verify permissions for your targeted environment. Interactive steps will guide you through the process.

The validate-auth command accepts the following flags.

Short FlagLong FlagDescriptionType
--cloud-envThe target cloud environment to validate permissions on. This can also be selected in the interactive wizard. The supported cloud environments are aws and azure.string
--outdirOutput directory for generated resources. Defaults to $(pwd)/out.string
-h--helpHelp with any command.-

Examples​

Here are some examples of using the validate-auth command and its supported flags.

Start the interactive steps.

palette validate-auth

Start the interactive steps and choose the cloud environment in advance.

palette validate-auth --cloud-env <aws|azure>

Start the interactive steps and specify the output directory for any generated resources.

palette validate-auth --outdir $(pwd)/resources

Interactive Steps​

The interactive steps change depending on the cloud environment chosen.

  1. Issue the validate-auth command using the Palette CLI.

    palette validate-auth

  2. When prompted, select AWS for the cloud environment.

  3. Provide the AWS Access Key ID for the IAM user that will perform the validation.

  4. Provide the AWS Secret Access Key for the IAM user that will perform the validation.

  5. Select either IAM User or IAM Role depending on what you want to check.

  6. Provide the IAM User name or IAM Role name depending on what was chosen in step 5. This is the user or role that will be deploying clusters in your environment.

  7. Choose the permission model to validate against. The Comprehensive model will check whether you have sufficient permissions for all Palette features. The Minimal model will only check for the privileges needed to create and delete clusters. Refer to the Required IAM Policies to learn more about AWS permissions needed by Palette.

  8. You are prompted to answer Will the cloud account be deploying EKS host clusters?. Enter y if you want to check for sufficient permissions to deploy Amazon EKS clusters, or n if you do not.

  9. Provide the default AWS region on which the validation will be performed. This should match the region where you intend to deploy clusters.

    Example.

    Default AWS region: eu-west-1

The validation process will now execute and output the results to your terminal.

Validator File​

During the interactive steps, a Validator file is generated that contains the permissions that the Validator is searching for. It also contains the secret used to authorize the validation task. You are prompted to keep or remove this file after the validation results are displayed.

Example.

 WARNING  Validator file validator-20250113_183600.yaml contains secret(s): AWS secret access key
Remove file validator-20250113_183600.yaml from disk? [Y/n]:

Enter y if you want to remove the Validator file, or n if you want to keep it.

Review Validation Results​

A report is generated and outputted to your terminal after the validation process is complete. The report varies depending on the outcome.

Succeeded​

If the validation is successful, the State field is set to Succeeded. The output varies slightly depending on the cloud environment.

When the IAM user or role provided has all sufficient privileges, then the validation results will appear similar to the following example.

=================
Validation Result
=================

Plugin:           AWS
Name:             validator-plugin-aws-aws-validator
Namespace:        N/A
State:            Succeeded

------------
Rule Results
------------

Validation Rule:        validation-paletteclusteroperator
Validation Type:        aws-iam-user-policy
Status:                 True
Last Validated:         2025-01-14T19:58:12Z
Message:                All required IAM user policy permissions were found

Failed​

If the validation is not successful, the State field is set to Failed. The Failures section contains additional information about the failure and will vary depending on the cloud environment.

In this example, several IAM permissions are missing for the PaletteClusterOperator IAM role.

=================
Validation Result
=================

Plugin:           AWS
Name:             validator-plugin-aws-aws-validator
Namespace:        N/A
State:            Failed

------------
Rule Results
------------

Validation Rule:        validation-paletteclusteroperator
Validation Type:        aws-iam-user-policy
Status:                 False
Last Validated:         2025-01-14T18:48:36Z
Message:                One or more required IAM permissions was not found, or a condition was not met

--------
Failures
--------
- Condition StringLike: iam:AWSServiceName=[autoscaling.amazonaws.com];  not applied to action(s) [iam:CreateServiceLinkedRole] for resource arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling from policy PaletteControllerPolicy
- v1alpha1.IamUserRule PaletteClusterOperator missing action(s): [autoscaling:CreateAutoScalingGroup autoscaling:DeleteAutoScalingGroup] for resource arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/* from policy PaletteControllerPolicy
- v1alpha1.IamUserRule PaletteClusterOperator missing action(s): [s3:DeleteObject] for resource arn:*:s3:::* from policy PaletteControllerPolicy
- v1alpha1.IamUserRule PaletteClusterOperator missing action(s): [secretsmanager:CreateSecret secretsmanager:DeleteSecret] for resource arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/* from policy PaletteNodesPolicy

Use the output to help you address the validation failures. In this example, the Validator identified two types of IAM permission issues, which are missing actions and missing conditions.

To resolve the missing actions, add the missing IAM permissions to the PaletteClusterOperator IAM user. The following table summarizes the missing actions and their required resource scopes, identifying which Palette policy should contain these permissions.

IAM PolicyMissing ActionsResource Scope
PaletteControllerPolicyautoscaling:CreateAutoScalingGroup
autoscaling:DeleteAutoScalingGroup		arn:*:autoscaling:*:*:autoScalingGroup:*:autoScalingGroupName/*
PaletteControllerPolicys3:DeleteObjectarn:*:s3:::*
PaletteNodesPolicysecretsmanager:CreateSecret
secretsmanager:DeleteSecret		arn:*:secretsmanager:*:*:secret:aws.cluster.x-k8s.io/*

To resolve the missing conditions, apply the required conditions to the specified actions. From interpreting the example extract below, the Validator detected that the PaletteControllerPolicy IAM policy requires a condition to be added for the iam:CreateServiceLinkedRole action to restrict service-linked role creation specifically to Auto Scaling services.

- Condition StringLike:
    iam:AWSServiceName=[autoscaling.amazonaws.com];  not applied to action(s) [iam:CreateServiceLinkedRole] for resource
    arn:*:iam::*:role/aws-service-role/autoscaling.amazonaws.com/AWSServiceRoleForAutoScaling from policy
    PaletteControllerPolicy

Resolve Failures​

Each plugin can report different types of validation failures. The resolution steps will vary depending on the specific plugin and failure type. Use the error output to identify and address each failure. The following table provides guidance for common failure scenarios.

PluginFailure MessageGuidance
AWSOne or more required IAM permissions was not found, or a condition was not metThe IAM user or role used by Palette is missing one or more required IAM permissions. Refer to Required IAM Policies for a comprehensive list of required IAM permissions and attach the missing permissions or policies.
AzurePrincipal lacks required permissions. See failures for details.The service principal used by Palette is missing one or more required permissions. Refer to Required Permissions for a comprehensive list of required permissions and attach the missing permissions or role assignments.