Control access with RBAC and service accounts

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Manage RBAC

Know the four RBAC objects

A Role lists allowed actions; a Binding gives the Role to users, groups or service accounts.

Object	Scope
Role	Rules in one namespace
ClusterRole	Rules for the whole cluster (or reused in namespaces)
RoleBinding	Gives a Role or ClusterRole inside one namespace
ClusterRoleBinding	Gives a ClusterRole in all namespaces

A rule = apiGroups + resources + verbs (get, list, watch, create, update, patch, delete).

4.2

Create a role and a binding

Use the imperative commands — fast and correct.

$kubectl create namespace shop
$kubectl create role pod-reader --verb=get,list,watch --resource=pods,pods/log -n shop
$kubectl create rolebinding mia-pod-reader --role=pod-reader --user=mia -n shop
$kubectl create clusterrole node-reader --verb=get,list --resource=nodes
$kubectl create clusterrolebinding ops-node-reader --clusterrole=node-reader --group=ops
$kubectl get role,rolebinding -n shop

4.3

Test permissions

kubectl auth can-i asks the API server — also for other users and service accounts.

$kubectl auth can-i list pods -n shop --as mia
yes
$kubectl auth can-i delete pods -n shop --as mia
no
$kubectl auth can-i --list -n shop --as system:serviceaccount:shop:deployer
$kubectl auth can-i '*' '*' --as admin

Exam tip

Always prove an RBAC task with auth can-i … --as … — yes for what is allowed, no for something that is not.

4.4

Use service accounts

A service account is the identity of pods. Give it a role, and set it in the pod spec.

$kubectl create serviceaccount deployer -n shop
$kubectl create rolebinding deployer-edit --clusterrole=edit --serviceaccount=shop:deployer -n shop
$kubectl create token deployer -n shop --duration=1h

pod-sa.yaml

apiVersion: v1
kind: Pod
metadata:
  name: tools
  namespace: shop
spec:
  serviceAccountName: deployer
  automountServiceAccountToken: true
  containers:
    - name: kubectl
      image: bitnami/kubectl:1.33
      command: ["sleep", "3600"]

Remember

Pods that do not need the API should have automountServiceAccountToken: false — fewer tokens to steal.

4.5

Add a user with a certificate

Kubernetes has no user database. A user is a client certificate signed by the cluster CA (or an identity from OIDC). The CertificateSigningRequest API signs it.

$openssl genrsa -out mia.key 2048
$openssl req -new -key mia.key -subj "/CN=mia/O=developers" -out mia.csr
$cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: mia
spec:
  request: $(base64 -w0 mia.csr)
  signerName: kubernetes.io/kube-apiserver-client
  usages: ["client auth"]
EOF
$kubectl certificate approve mia
$kubectl get csr mia -o jsonpath='{.status.certificate}' | base64 -d > mia.crt
$kubectl config set-credentials mia --client-key=mia.key --client-certificate=mia.crt --embed-certs=true
$kubectl config set-context mia@lab --cluster=lab --user=mia --namespace=shop

The CN is the user name, every O is a group — used in bindings.

4.6

Use the built-in cluster roles

Some ClusterRoles exist already; bind them instead of writing your own.

ClusterRole	Gives
`cluster-admin`	Everything (use very rarely)
`admin`	Everything in a namespace, also RBAC
`edit`	Create and change most objects, no RBAC
`view`	Read most objects (not Secrets)

All commands in this chapter