Cloud Permissions

KubeManta's cloud features are read-only: the ☁ Cloud toggle in the Network tab visualises your VPC / VNet topology by making a small number of describe/list API calls. No resources are created, modified, or deleted.

Credentials are configured in Admin → ☁ Cloud and stored encrypted (AES-256-GCM) in SQLite inside your cluster's PVC. Secrets are masked (••••) in all API responses and never appear in logs.

---

AWS

Required IAM policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "KubeMantaCloudRead",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeInstances"
      ],
      "Resource": "*"
    }
  ]
}

sts:GetCallerIdentity (used only for the credential test) is always allowed regardless of IAM policy. sts:AssumeRole is governed by the target role's trust policy, not the caller's attached policies.

Auth modes

Mode	When to use	Fields
Access Keys	Long-lived IAM user	Region, Access Key ID, Secret Access Key
IAM Role ARN	Cross-account or same-account role	Region, Role ARN
SSO Temp	AWS IAM Identity Center (short-lived)	Region, Access Key ID, Secret Access Key, Session Token
Auto (IRSA)	EKS with IRSA configured	No fields — uses AWS_ROLE_ARN env var automatically

For SSO Temp: log in to the IAM Identity Center portal → select AWS account → Access Keys → copy all three values. Credentials expire in 8–12 hours.

For IRSA: attach the IAM policy above to the IAM role referenced by AWS_ROLE_ARN. No manual credential entry needed.

Verify

1. Open Admin → ☁ Cloud in the KubeManta UI.
2. Fill in credentials and click Test.
3. Expect: Connected as arn:aws:iam::ACCOUNT_ID:user/NAME (or the assumed-role ARN).
4. Toggle ☁ Cloud in the Network tab — VPC card and subnet swimlanes should appear.

---

GCP

Required IAM role

roles/compute.networkViewer on the GCP project.

If you prefer a custom role with minimal permissions:

compute.networks.list
compute.subnetworks.list

Auth modes

Mode	When to use	Fields
Service Account JSON	Any GCP cluster	GCP Project ID, Service Account JSON key (paste full contents)
Workload Identity	GKE with Workload Identity	GCP Project ID (optional — auto-detected from node spec.providerID)

Workload Identity setup

# 1. Create a GCP service account with compute.networkViewer
gcloud iam service-accounts create kubemanta-cloud-viewer \
  --display-name="KubeManta Cloud Viewer" --project=YOUR_PROJECT_ID

gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
  --member="serviceAccount:kubemanta-cloud-viewer@YOUR_PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/compute.networkViewer"

# 2. Bind it to the KubeManta Kubernetes SA
gcloud iam service-accounts add-iam-policy-binding \
  kubemanta-cloud-viewer@YOUR_PROJECT_ID.iam.gserviceaccount.com \
  --role="roles/iam.workloadIdentityUser" \
  --member="serviceAccount:YOUR_PROJECT_ID.svc.id.goog[kubemanta-system/kubemanta]"

# 3. Annotate the Kubernetes SA
kubectl annotate serviceaccount kubemanta -n kubemanta-system \
  iam.gke.io/gcp-service-account=kubemanta-cloud-viewer@YOUR_PROJECT_ID.iam.gserviceaccount.com

Verify

1. Open Admin → ☁ Cloud and click Test next to GCP.
2. Expect: Connected to project YOUR_PROJECT_ID.
3. Toggle ☁ Cloud — VPC name and subnet cards should appear.

---

Azure

Required RBAC role

Assign the built-in Reader role scoped to the subscription or the resource group containing your AKS VNet:

# Subscription scope
az role assignment create \
  --assignee CLIENT_ID_OR_OBJECT_ID \
  --role Reader \
  --scope /subscriptions/SUBSCRIPTION_ID

# Narrower (preferred): resource-group scope
az role assignment create \
  --assignee CLIENT_ID_OR_OBJECT_ID \
  --role Reader \
  --scope /subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP

Or create a custom role with only the actions KubeManta uses:

{
  "Name": "KubeManta Cloud Viewer",
  "IsCustom": true,
  "Actions": [
    "Microsoft.Network/virtualNetworks/read",
    "Microsoft.Network/virtualNetworks/subnets/read",
    "Microsoft.Resources/subscriptions/read"
  ],
  "NotActions": [],
  "AssignableScopes": ["/subscriptions/SUBSCRIPTION_ID"]
}

Auth modes

Mode	When to use	Fields
Client Secret	App Registration	Subscription ID, Tenant ID, Client ID, Client Secret
Managed Identity	AKS managed identity	Subscription ID, Client ID (omit for system-assigned)

Client Secret setup

az ad app create --display-name "kubemanta-cloud-viewer"
az ad sp create --id APP_ID
az role assignment create --assignee SP_OBJECT_ID --role Reader \
  --scope /subscriptions/SUBSCRIPTION_ID/resourceGroups/RESOURCE_GROUP
az ad app credential reset --id APP_ID --append

Verify

1. Open Admin → ☁ Cloud and click Test next to Azure.
2. Expect: Connected to subscription YOUR_SUBSCRIPTION_DISPLAY_NAME.
3. Toggle ☁ Cloud — VNet card and subnet cards should appear.