Granting installation permissions

Grant necessary permissions for Automation Suite installation on EKS/AKS.

Important:

Installation permissions are relevant only if you cannot provide admin privileges to the Automation Suite installer. If you can provide the required admin privileges to the installer, you do not need to follow the instructions in this section.

Automation Suite relies on specific permissions during installation. These permissions are assigned to the service account, which plays a pivotal role in installing the various Automation Suite components.

To configure all the permissions required for installation, perform the steps in this section.

Step 1: Creating a service account

To create a service account, take the following steps:

1. Create the <uipath> namespace:

   kubectl create namespace <uipath>
   

2. Create a service account named uipathadmin:

    kubectl create serviceaccount uipathadmin -n <uipath>
   

3. Use the existing admin cluster role to grant admin permissions to the uipathadmin service account in the <uipath> namespace:

   kubectl create rolebinding uipathadmin --clusterrole=admin --serviceaccount=<uipath>:uipathadmin -n <uipath>
   

Step 2: Creating the required roles

The uipathadmin service account requires certain permissions during the Automation Suite installation. You provide the necessary permissions by creating roles. To create each role, save its configuration as a YAML file and run the following command, replacing the <file_name.yaml> placeholder with the actual name of the YAML file:

kubectl apply -f <file_name.yaml>

You can create the YAML file for each role by copying the configuration from the following sections.

Query the namespace [read-only]

Required to check whether the namespaces, such as the <istio-system> namespace, are available or not.

The following example shows the namespace-reader-clusterrole ClusterRole configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-reader-clusterrole
rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get"]

List nodes and CRDs [read-only]

The prerequisite check and diagnostic health check tool require this permission to perform node validations, such as the capacity available on the node.

The following example shows the list-nodes-and-crd-clusterrole ClusterRole configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: list-nodes-and-crd-clusterrole
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["list", "get"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["list"]
  - apiGroups: ["metrics.k8s.io"]
    resources: ["nodes"]
    verbs: ["list", "get"]
  - apiGroups: ["scheduling.k8s.io"]
    resources: ["priorityclasses"]
    verbs: ["get"]

Note:

If these permissions are not available in your cluster, Automation Suite Robots cannot automatically determine the maximum number of concurrent jobs. To define the limit explicitly, configure concurrency_limit in the asrobots section of input.json. For details, refer to Automation Suite Robots-specific configuration.

Get storage classes [read-only]

The prerequisite check and diagnostic health check tool require this permission to perform the validations.

The following example shows the storage-class-reader ClusterRole configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: storage-class-reader
rules:
  - apiGroups: ["storage.k8s.io"]
    resources: ["storageclasses"]
    verbs: ["get"]

uipath roles [write]

Most of the Automation Suite installation is performed via ArgoCD; however, some components are installed via Helm charts.

The uipathctl tool runs an installation job that executes the Helm chart installation. Connecting to the kube-api-server and installing the Helm chart in the <uipath> namespace requires a namespace-level role-creator role.

The following example shows the uipath-automationsuite-role Role configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: uipath-automationsuite-role
  namespace: <uipath>
rules:
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings"]
    verbs: ["*"]
  - apiGroups: ["*"]
    resources: ["secrets", "configmaps"]
    verbs: ["get", "watch", "list", "patch", "update", "create"]
  - apiGroups: ["security.istio.io", "networking.istio.io"]
    resources: ["*"]
    verbs: ["*"]

<istio-system> roles [write]

Note:

Provide these permissions only if you want the installer to configure the WASM plugin. Otherwise, do not provide the permissions.

The following operations are performed in the <istio-system> namespace:

1. The Automation Suite prerequisite check tool reads pods and services to validate that Istio is installed and configured properly.
2. Automation Suite installs the WASM plugin to configure path-based routing rules. This requires creating an image pull secret and namespace-level role creator permissions.

The following example shows the istio-system-automationsuite-role Role configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: istio-system-automationsuite-role
  namespace: <istio-system>
rules:
  - apiGroups: [""]
    resources: ["services", "pods"]
    verbs: ["list"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings"]
    verbs: ["*"]
  - apiGroups: ["*"]
    resources: ["secrets", "configmaps"]
    verbs: ["get", "watch", "list", "patch", "update", "create"]
  - apiGroups: ["networking.istio.io", "extensions.istio.io"]
    resources: ["*"]
    verbs: ["*"]

<istio-system> roles [read-only]

Note:

Provide these permissions if Istio and the WASM plugin are already configured.

The following operations are performed in the <istio-system> namespace:

1. Read pods and services to validate Istio installation.
2. The get secrets permission is required to copy the certificate file from the <istio-system> namespace to the <uipath> namespace.

The following example shows the istio-system-automationsuite-role Role configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: istio-system-automationsuite-role
  namespace: <istio-system>
rules:
  - apiGroups: [""]
    resources: ["services", "pods"]
    verbs: ["list"]
  - apiGroups: ["*"]
    resources: ["secrets"]
    resourceNames: ["istio-ingressgateway-certs"]
    verbs: ["get"]

Step 3: Binding the roles

You must bind the roles that you created in the previous step to the uipathadmin service account, by running the following commands:

kubectl -n <istio-system> create rolebinding istio-system-automationsuite-rolebinding \
  --role=istio-system-automationsuite-role --serviceaccount=<uipath>:uipathadmin
  
kubectl -n <istio-system> create rolebinding namespace-reader-rolebinding \
  --clusterrole=namespace-reader-clusterrole --serviceaccount=<uipath>:uipathadmin
  
kubectl -n <uipath> create clusterrolebinding list-nodes-and-crd-rolebinding \
  --clusterrole=list-nodes-and-crd-clusterrole --serviceaccount=<uipath>:uipathadmin
  
kubectl -n <uipath> create rolebinding uipath-automationsuite-rolebinding \
  --role=uipath-automationsuite-role --serviceaccount=<uipath>:uipathadmin
  
kubectl -n <uipath> create clusterrolebinding storage-class-reader-binding \
  --clusterrole=storage-class-reader --serviceaccount=<uipath>:uipathadmin

# This step is needed only if you want installer to configure the WASM Plugin. Otherwise skip it.
kubectl -n <istio-system> create rolebinding uipadmin-istio-system \
  --clusterrole=admin --serviceaccount=<uipath>:uipathadmin

Step 4: Generating the kubeconfig file

After you assign all the permissions to the service account, you must create a kubeconfig file to pass to the uipathctl tool for the installation.

Generating the kubeconfig file on Linux or Mac

To generate the kubeconfig file on Linux or Mac, run the following commands:

# Create a token
token="$(kubectl -n <uipath> create token uipathadmin --duration=8760h)"
# copy current kubeconfig to a temp file
mkdir temp
cp ~/.kube/config temp/kubeconfig.tmp
# Find the user name and unset it in the temp file
kube_user_name="$(kubectl config view -o jsonpath="{.users[0].name}")"
kubectl -n <uipath> config unset users."${kube_user_name}" --kubeconfig="temp/kubeconfig.tmp"
# Update the credentials in the temp file
kubectl -n <uipath> --kubeconfig="temp/kubeconfig.tmp" config set-credentials uipathadmin --token="$token"
# Set the context and the namespace
kubectl --kubeconfig="temp/kubeconfig.tmp" config set-context --current --namespace=<uipath> --user=uipathadmin
mv temp/kubeconfig.tmp temp/uipathadminkubeconfig

If the operation was successful, you should see a kubeconfig file named uipathadminkubeconfig.

Generating the kubeconfig file on Windows

Note:

You must perform this step using Windows Powershell.

To generate the kubeconfig file on Windows, run the following commands:

# Create a token
$token = kubectl -n <uipath> create token uipathadmin --duration=8760h
# copy current kubeconfig to a temp file
mkdir temp
cp ~/.kube/config temp/kubeconfig.tmp
# Find the user name and unset it in the temp file
$kube_user_name = kubectl config view -o jsonpath="{.users[0].name}"
kubectl -n <uipath> config unset users."${kube_user_name}" --kubeconfig="temp/kubeconfig.tmp"
# Update the credentials in the temp file
kubectl -n <uipath> --kubeconfig="temp/kubeconfig.tmp" config set-credentials uipathadmin --token="$token"
# Set the context and the namespace
kubectl --kubeconfig="temp/kubeconfig.tmp" config set-context --current --namespace=<uipath> --user=uipathadmin
mv temp/kubeconfig.tmp temp/uipathadminkubeconfig

If the operation was successful, you should see a kubeconfig file named uipathadminkubeconfig in the temp folder.