Upbound allows you to attach self-hosted Spaces and enables a streamlined operations and debugging experience in your Console.

Usage

Attach

Before you begin, make sure you have:

• an existing Upbound organization in Upbound SaaS.
• the up CLI installed and logged into your organization
• kubectl installed with the kubecontext of your self-hosted Space cluster.

Create a new UPBOUND_SPACE_NAME. If you don’t create a name, up automatically generates one for you:

export UPBOUND_SPACE_NAME=

Attach the Space to the Console:

up space attach "${UPBOUND_SPACE_NAME}"

This command installs a Connect agent, creates a service account, and configures permissions in your Upbound cloud organization in the upbound-system namespace of your Space.

Go to the Upbound Console, log in, and choose the newly attached Space from the Space selector dropdown.

Detach

To detach a self-hosted Space or a deleted self-hosted Space, run the following command:

up space detach "${UPBOUND_SPACE_NAME}"

If the Space still exists, this command uninstalls the Connect agent and deletes the associated service account and permissions.

Security model

Architecture

Data path

Upbound uses a Pub/Sub model over TLS to communicate between Upbound’s global console and your self-hosted Space. Self-hosted Spaces establish a secure connection with connect.upbound.io and subscribe to an endpoint. The Upbound Console communicates to the Space through that endpoint. The data flow is:

1. Users sign in to the Upbound Console, redirecting to authenticate with an organization’s configured Identity Provider via SSO.
2. Once authenticated, actions in the Console, like listing control planes or specific resource types from a control plane. These requests post as messages to the Upbound Connect service.
3. A user’s self-hosted Space polls the Upbound Connect service periodically for new messages, verifies the authenticity of the message, and fulfills the request contained.
4. A user’s self-hosted Space returns the results of the request to the Upbound Connect service and the Console renders the results in the user’s browser session.

Upbound never stores data originated from a self-hosted Space. The data is transient and only exposed in the user’s browser session. The Console needs this data to render your resources and control planes in the UI.

Data transmitted

Users interact with the Upbound Console to generate request queries to the Upbound Connect Service while exploring, managing, or debugging a self-hosted Space. These requests send data back to the user’s browser session in the Console, including:

• Metadata for the Space
• Metadata for managed control planes in the state
• Configuration manifests for various resource types within your Space: Crossplane managed resources, composite resources, composite resource claims, Upbound shared secrets, Upbound shared backups, Crossplane providers, ProviderConfigs, Configurations, and Crossplane Composite Functions.

Upbound can’t see your data. Upbound doesn’t have access to session-based data rendered for your users in the Upbound Console. Upbound has no information about your self-hosted Space, other than that you’ve attached a self-hosted Space.

Threat vectors

Only users with editor or administrative permissions can make changes using the Console like creating or deleting control planes or groups.