Identity and Access
OSC uses a per-customer dedicated identity service based on Keycloak and role-based access control to separate platform administration from customer administration. Kubernetes access is integrated through standard OpenID Connect mechanisms.
Customers access the OSC Console and managed Kubernetes service through assigned identities. Users can be grouped and given permissions that match their responsibilities. A platform owner may manage projects and clusters, while application teams receive access only to the environments they operate.
At Kubernetes level, permissions are enforced through Kubernetes RBAC. Cluster administrators can define roles for namespaces, applications and operational teams. These permissions are separate from the internal privileges used by OSC to operate the underlying platform.
The managed service is built so that customers do not need credentials for the infrastructure control planes. Gardener uses provider-managed identities to provision machines, networks and storage on behalf of a Shoot. The customer receives access to the resulting Kubernetes cluster, not to the internal cloud orchestration layer.
Customers should follow least-privilege principles, use groups instead of individual assignments where possible and separate day-to-day application access from emergency administration. Access reviews and the removal of unused accounts remain part of the customer's governance process.