Skip to main content

Bootstrap

Mission Control allows nothing by default: a new user can't see or do anything until a RoleBinding grants them access. So on a fresh installation, someone has to be able to sign in and create the first RoleBindings.

Mission Control solves this by shipping an admins team, already bound to the shipped admin Role, and to plugin-admin, which lets admins run plugin operations. Whoever is in that team is an admin from their first sign-in.

How the first people get into the team depends on how users sign in. Mission Control SaaS uses Clerk. A self-hosted installation uses Kratos, optionally with single sign-on, unless you configured basic auth.

AuthenticationFirst admin
KratosThe local admin@local user, which Mission Control creates in admins
Basic authThe local admin@local user, which Mission Control creates in admins
ClerkYour Clerk organization admins, who join admins when they sign in

Kratos and basic auth​

Mission Control creates a local user, admin@local, and adds it to the admins team every time it starts. Sign in as admin@local to set up access for everyone else.

The default username is admin@local and the password can be retrieved with:

kubectl get secret  mission-control-admin-password \
  -n mission-control \
  --template='{{.data.password | base64decode}}'

The password comes from the ADMIN_PASSWORD environment variable, which the Helm chart sets from the mission-control-admin-password secret. The chart generates a random password when it creates the secret.

Once you're signed in:

  1. Add the people who should be admins to the admins team from Settings → Teams. A person appears there once they've signed in, or once you've invited them from Settings → Users.
  2. Give everyone else access. For example, give everyone the shipped viewer Role so they can browse the catalog, then grant more to the teams that need it. See the Quickstart.

If you map your identity provider's groups to teams with a team mapper, you can return admins for your admin group instead of adding people by hand. A team mapper never removes admin@local from the team.

Clerk​

There's no admin@local with Clerk. Instead, your Clerk organization decides who the first admins are. See Getting started with SaaS for signing up and inviting your team.

When a user signs in, Mission Control runs a team mapper over their Clerk session claims. Unless a custom mapper is configured, the default mapper puts:

Clerk userTeam
Organization admins (org_role is org:admin, or role is admin)admins
Guests (org_role is org:guest)No team
Everyone elseviewers

So your Clerk organization admins are Mission Control admins as soon as they sign in, and a user who leaves the admin role in Clerk leaves the admins team on their next request.

viewers isn't shipped. Regular members can sign in but can't see anything until you give them access. Either give everyone the viewer Role, as in the Quickstart, or create a team named viewers and bind a Role to it.

A custom mapper is set with Mission Control's --clerk-team-mapper flag. If you use one, make sure it still returns admins for the people who should be admins, or no one can manage access. See Team Mapping.

External identity providers​

Users who sign in through an external identity provider never become admins on their own. A provider can only add its users to admins if you list admins among the teams it's allowed to manage, and it warns you when you do.

Getting admin access back​

The admins team itself and its two RoleBindings can't be renamed, changed, or deleted. Its members can be, from Settings → Teams. If the team or its bindings go missing, Mission Control recreates them when it starts. Even a RoleBinding with deny: true (see Refusing a Role) can't stop admins from managing RoleBindings.

If every admin is lost, for example because all members were removed from admins:

  • Kratos and basic auth: restart Mission Control. It adds admin@local back to admins.
  • Clerk: sign in as a Clerk organization admin. With the default team mapper, or a custom one that returns admins, you're added back to admins on your first request.

Next steps​