DOCSEARCHbyAlgolia
Submit Docs

Otterize Documentation

website·Indexed 33 days ago

https://docs.otterize.com/

A declarative, zero-trust approach to access management for streamlining workload IAM. Otterize provides tools like the Intents Operator and Network Mapper to manage access for Kubernetes, PostgreSQL, MySQL, Kafka, and cloud IAM (AWS, GCP, Azure), supporting integrations with Istio, Linkerd, GitHub, and GitLab.

Tokens
54.8K
Snippets
297
Records
404
Agent score
63%

What's inside Otterize

  1. Overview of Otterize MySQL Just-in-Time Access

    Otterize provides just-in-time username-and-password pairs for workloads via Kubernetes Secrets. It manages database access by automatically applying SQL GRANT statements based on ClientIntents declarations. The credentials operator creates unique credentials for each workload, while the intents operator ensures the database permissions remain up to date.

  2. Overview of Otterize PostgreSQL Access Management

    Otterize provides secure access to PostgreSQL databases from Kubernetes using Intent-Based Access Control (IBAC). It automates the creation of just-in-time username-and-password pairs delivered as Kubernetes Secrets and manages database permissions via SQL GRANT and REVOKE commands based on ClientIntents declarations. It can also analyze database access patterns to automatically generate these declarations.

  3. Overview of the Otterize network mapper

    The Otterize network mapper creates a map of in-cluster traffic by capturing DNS traffic and inspecting active TCP connections (similar to netstat). It resolves participating IP addresses to Pods and their root ownership objects to determine service identities. This map can be exported as JSON or YAML to create ClientIntents Kubernetes resources, which the Otterize intents operator uses to apply network policies or Kafka ACLs for intent-based access control.

  4. Overview of PostgreSQL table-level access visualization

    Otterize visualizes table-level access to PostgreSQL databases by collecting PostgreSQL audit logs and associating them with client workload identities. Currently, visibility log collection is exclusively available for PostgreSQL instances running on GCP Cloud SQL.

  5. Overview of Otterize access management

    Otterize is a declarative, zero-trust approach to workload IAM (Identity and Access Management) deployed to Kubernetes via a Helm chart. It automates the process of mapping access, provisioning policies, and issuing credentials through three core open-source components: the network mapper, the intents operator, and the credentials operator.

  6. Overview of Otterize Cloud capabilities

    Otterize Cloud is a cloud-based control plane used to deploy and manage Intent-Based Access Control (IBAC) systems. It integrates with Otterize OSS operators (intents operator, network mapper, and credentials operator) running in Kubernetes clusters to configure access between pods and Kafka nodes using network policies and Kafka ACLs.

    Key features include:

    • Visibility: Visualizing the network map of connected clusters.
    • Confidence (Shadow Mode): Running without enforcement to preview what traffic would be blocked before enabling active enforcement.
    • Operationalization: Mapping Kubernetes namespaces to development environments (e.g., dev, staging, production) and providing an optional managed identity service as an alternative to self-operating SPIRE.

  7. Overview of Otterize OSS components for IBAC

    Otterize OSS provides intent-based access control (IBAC) for Kubernetes clusters through three primary components:

    1. Otterize Intents Operator: Translates ClientIntents resources into actual access controls. Current plugins include a network policies manager (for pod-to-pod access) and an ACL configurator (for in-Kubernetes Kafka clusters).
    2. Otterize Credentials Operator: Manages pod identities and certificates by integrating with SPIFFE/SPIRE or the Otterize Cloud-managed credentials service.
    3. Otterize Network Mapper: Sniffs pod-to-pod traffic to build a network map, which can be used independently or exported as client intents files to bootstrap IBAC.

  8. Overview of the Otterize intents operator

    The Otterize intents operator is an open-source Kubernetes operator that automatically manages native access policies—including network policies, Kafka ACLs, and cloud IAM roles—based on declared service intents defined in ClientIntents CRDs.

  9. Analyze network traffic using the Otterize Cloud Access Graph

    When Otterize OSS is connected to Otterize Cloud, the access graph provides a browser-based visualization of the network map. Key capabilities include:

    • Filtering the map by cluster, namespace, or environment.
    • Filtering by time to eliminate outdated traffic without resetting the mapper.
    • Identifying protected workloads and detecting blocked client calls (when the intents operator is connected).

  10. Retrieve environment details using otterize environments get

    Returns detailed information about a specific environment using its unique environment ID.
    otterize environments get <environment-id>

  11. Retrieve organization details

    Use the otterize organizations get command to retrieve detailed information about a specific organization using its unique organization ID.
    otterize organizations get <organization-id>

  12. Automate ClientIntent updates using GitLab integration

    The Otterize GitLab integration automates the resolution of drifts between defined policies (ClientIntents) and actual application traffic. When the Network Mapper detects traffic patterns that differ from the ClientIntents stored in a remote repository, Otterize automatically submits a merge request to a specified branch to update the intents to reflect actual traffic. This allows developers to resolve access discrepancies using standard GitOps workflows.