Granting installation permissions with cluster roles

Grant cluster-scoped ClusterRole and ClusterRoleBinding permissions to the Automation Suite installer service account and cluster admin users for OpenShift installations.

Important:

Installation permissions are relevant only if you cannot provide admin privileges to the Automation Suite installer. If you can provide the required admin privileges to the installer, you do not need to follow the instructions in this section.

This page assumes you can grant the Automation Suite installer service account (uipathadmin) cluster-scoped permissions (ClusterRole and ClusterRoleBinding). If your security policy prohibits granting any cluster-scoped permissions, refer to Granting installation permissions without cluster roles instead.

If you install multiple Automation Suite instances on the same cluster, you must grant permissions for the other namespaces where you install Automation Suite.

Automation Suite relies on specific permissions during installation. These permissions are assigned to the service account, which plays a pivotal role in installing the various Automation Suite components.

To configure all the permissions required for installation, perform the steps in this section.

Note:

You must execute the commands referenced in this section from a Linux, Windows, or macOS machine that has access to the OpenShift Kubernetes API server.

Step 1: Creating a service account

To create a service account, take the following steps:

1. Create the <uipath> namespace and project:

   oc get namespace <uipath> || oc new-project <uipath>
   

2. Set the default namespace and project to <uipath>:

   oc project <uipath>
   

   All subsequent oc commands will operate within the <uipath> namespace.

3. Create a service account named uipathadmin:

   oc create serviceaccount uipathadmin
   

4. Use the existing admin cluster role to grant admin permissions to the uipathadmin service account in the <uipath> namespace:

   oc create rolebinding uipathadmin --clusterrole=admin --serviceaccount=<uipath>:uipathadmin
   

Step 2: Creating the required roles

The uipathadmin service account requires certain permissions during the Automation Suite installation. You provide the necessary permissions by creating roles.

To create each role, save its configuration as a YAML file and run the following command, replacing the <file_name.yaml> placeholder with the actual name of the YAML file:

oc apply -f <file_name.yaml>

You can create the YAML file for each role by copying the configuration from the following sections.

Query the namespace [read-only]

Required to check whether the namespaces, such as the <istio-system> namespace, are available or not.

The following example shows the namespace-reader-clusterrole configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-reader-clusterrole
rules:
  - apiGroups: [""]
    resources: ["namespaces"]
    verbs: ["get"]

List nodes and CRDs [read-only]

The prerequisite check and diagnostic health check tool require this permission to perform the node validations, such as the capacity available on the node.

The following example shows the list-nodes-and-crd-clusterrole configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: list-nodes-and-crd-clusterrole
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["list", "get"]
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["list"]
  - apiGroups: ["metrics.k8s.io"]
    resources: ["nodes"]
    verbs: ["list", "get"]
  - apiGroups: ["scheduling.k8s.io"]
    resources: ["priorityclasses"]
    verbs: ["get"]

Note:

If these permissions are not available in your cluster, Automation Suite Robots cannot automatically determine the maximum number of concurrent jobs. To define the limit explicitly, configure concurrency_limit in the asrobots section of input.json. For details, refer to Automation Suite Robots-specific configuration.

uipath roles [write]

Most of the Automation Suite installation is performed via ArgoCD; however, the installation of some components is performed via Helm chart.

The uipathctl tool runs an installation job that executes the installation of the Helm chart. Connecting to the kube-api-server and installing the Helm chart in the <uipath> namespace require a namespace-level role-creator role.

The following example shows the uipath-automationsuite-role configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: uipath-automationsuite-role
  namespace: <uipath>
rules:
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings"]
    verbs: ["get", "watch", "list", "patch", "update", "create"]
  - apiGroups: [""]
    resources: ["secrets", "configmaps"]
    verbs: ["get", "watch", "list", "patch", "update", "create"]
  - apiGroups: ["security.istio.io", "networking.istio.io"]
    resources: ["*"]
    verbs: ["get", "watch", "list", "patch", "update", "create", "delete"]

<istio-system> roles [write]

Note:

Provide these permissions only if you want the installer to configure the WebAssembly (WASM) plugin. Otherwise, do not provide the permissions.

The following operations are performed in the <istio-system> namespace:

1. The Automation Suite prerequisite check tool reads the pods and services in the <istio-system> namespace to validate that Istio is installed and configured properly.
2. Automation Suite installs the WASM plugin in the <istio-system> namespace to configure the path-based routing rules, using uipathctl to run a Helm-based installation job. This requires creating an imagepullsecret to pull the image from the registry, and a role creator for the <istio-system> namespace.

The following example shows the istio-system-automationsuite-role configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: istio-system-automationsuite-role
  namespace: <istio-system>
rules:
  - apiGroups: [""]
    resources: ["services", "pods"]
    verbs: ["list"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings"]
    verbs: ["*"]
  - apiGroups: ["*"]
    resources: ["secrets", "configmaps"]
    verbs: ["get", "watch", "list", "patch", "update", "create"]
  - apiGroups: ["networking.istio.io", "extensions.istio.io"]
    resources: ["*"]
    verbs: ["*"]

<istio-system> roles [read-only]

Note:

Provide these permissions if you have already configured Istio and installed the WASM plugin.

The following operations are performed in the <istio-system> namespace:

1. The Automation Suite prerequisite check tool reads the pods and services in the <istio-system> namespace to validate that Istio is installed and configured properly.
2. The get secrets permission is required to copy the certificate file from the <istio-system> namespace to the <uipath> namespace.

The following example shows the istio-system-automationsuite-role configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: istio-system-automationsuite-role
  namespace: <istio-system>
rules:
  - apiGroups: [""]
    resources: ["services", "pods"]
    verbs: ["list"]
  - apiGroups: ["*"]
    resources: ["secrets"]
    resourceNames: ["istio-ingressgateway-certs"]
    verbs: ["get"]

Step 3: Binding the roles

You must bind the roles that you created in the previous step to the uipathadmin service account, by running the following commands:

oc project <istio-system>
oc create rolebinding istio-system-automationsuite-rolebinding \
  --role=istio-system-automationsuite-role --serviceaccount=<uipath>:uipathadmin
oc create rolebinding namespace-reader-rolebinding \
  --clusterrole=namespace-reader-clusterrole --serviceaccount=<uipath>:uipathadmin
oc project <uipath>
oc create clusterrolebinding list-nodes-and-crd-rolebinding \
  --clusterrole=list-nodes-and-crd-clusterrole --serviceaccount=<uipath>:uipathadmin
oc create rolebinding uipath-automationsuite-rolebinding \
  --role=uipath-automationsuite-role --serviceaccount=<uipath>:uipathadmin

# This step is needed only if you want the installer to configure the WASM Plugin. Otherwise skip it.
oc -n <istio-system> create rolebinding uipadmin-istio-system \
  --clusterrole=admin --serviceaccount=<uipath>:uipathadmin

Step 4: Generating the kubeconfig file

After you assign all the permissions to the service account, you must create a kubeconfig file to pass to the uipathctl tool for the installation.

Generating the kubeconfig file on Linux or Mac

To generate the kubeconfig file on Linux or Mac, run the following commands:

# For generating kubeconfig
# Creates the token for uipathadmin service account
token=$(oc -n <uipath> create token uipathadmin --duration=8760h)
# Getting api-server details
server=$(oc config view -o jsonpath="{.clusters[]..server}")
# Login logs on using the provided token and server and outputs kubeconfig at the provided path.
oc login --server=$server --token=$token --kubeconfig=uipathadminkubeconfig --insecure-skip-tls-verify=true

If the operation was successful, you should see a kubeconfig file named uipathadminkubeconfig.

Generating the kubeconfig file on Windows

Note:

You must perform this step using Windows Powershell.

To generate the kubeconfig file on Windows, run the following commands:

# For generating kubeconfig
# Creates the token for uipathadmin service account
$token = oc -n <uipath> create token uipathadmin --duration=8760h
# Getting api-server details
$server = oc config view -o jsonpath="{.clusters[]..server}"
# Login logs on using the provided token and server and outputs kubeconfig at the provided path.
oc login --server=$server --token=$token --kubeconfig=uipathadminkubeconfig --insecure-skip-tls-verify=true

If the operation was successful, you should see a kubeconfig file named uipathadminkubeconfig in the temp folder.

Step 5: Using the generated kubeconfig file

You must use the uipathadminkubeconfig file for all subsequent uipathctl commands in this workflow, including prerequisite checks, installation, and health checks. If you do not, uipathctl falls back to the default kubeconfig file, which may authenticate with cluster-admin privileges instead of the restricted uipathadmin service account.

For details on how to specify the kubeconfig file, refer to Specifying the kubeconfig file.