Chapter 9.1 - RBAC (Role-Based Access Control)

Learning Objectives

By the end of this chapter, you will be able to:

• Understand what RBAC is and why to use it
• Create Roles and ClusterRoles
• Create RoleBindings and ClusterRoleBindings
• Understand verbs and resources
• Manage permissions for users and Service Accounts
• Apply the principle of least privilege

---

Introduction

RBAC (Role-Based Access Control) is the Kubernetes authorization mechanism that controls who can do what in the cluster. It is essential for security and compliance.

---

Key Concepts

Roles vs ClusterRoles

Role: Permissions within a specific namespace
ClusterRole: Permissions at the cluster level (all namespaces)

RoleBindings vs ClusterRoleBindings

RoleBinding: Binds a Role to users within a namespace
ClusterRoleBinding: Binds a ClusterRole to users at the cluster level

---

Creating a Role

Basic Role

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]  # Core API group (no prefix)
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Result: Allows reading Pods in the default namespace.

Role with Multiple Resources

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: app-manager
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]

---

Creating a ClusterRole

ClusterRole for Nodes

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "watch", "list"]

Result: Allows reading nodes across the entire cluster.

ClusterRole with ResourceNames

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["my-secret", "another-secret"]
  verbs: ["get", "list"]

Result: Access only to the specified secrets.

---

Verbs (Actions)

Verbs define the authorized actions:

Verb	Description
get	Read a resource
list	List resources
watch	Watch resources
create	Create a resource
update	Update a resource
patch	Partially modify a resource
delete	Delete a resource
deletecollection	Delete multiple resources

Wildcard: * for all actions.

---

Resources

Resources are the Kubernetes objects:

• pods, services, configmaps, secrets
• deployments, replicasets, statefulsets
• nodes, namespaces, persistentvolumes
• Etc.

Wildcard: * for all resources.

---

RoleBinding

Binding a Role to a User

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: alice
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Binding a Role to a ServiceAccount

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: ServiceAccount
  name: my-app-sa
  namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Binding a ClusterRole to a User (Namespace Scope)

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-nodes
  namespace: default
subjects:
- kind: User
  name: bob
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: node-reader
  apiGroup: rbac.authorization.k8s.io

Result: Bob can read nodes, but only within the default namespace.

---

ClusterRoleBinding

Binding a ClusterRole at the Cluster Level

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-binding
subjects:
- kind: User
  name: admin
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

Result: The admin user has cluster-admin permissions across the entire cluster.

---

Predefined Roles

Kubernetes provides predefined ClusterRoles:

cluster-admin

Full access to the cluster:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-admin
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
- nonResourceURLs: ["*"]
  verbs: ["*"]

admin

Full access within a namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: admin
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

edit

Can modify resources (except RBAC):

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: edit
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["*"]
  verbs: []  # No RBAC access

view

Read-only:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: view
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list", "watch"]

---

Complete Example: Developer

Step 1: Create the Role

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: developer
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps", "secrets"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "create", "update", "patch", "delete"]

Step 2: Create the RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-binding
  namespace: development
subjects:
- kind: User
  name: developer1
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

Result: developer1 can manage applications in the development namespace.

---

Useful Commands

Verification

# View Roles
kubectl get roles
kubectl get rolebinding

# View ClusterRoles
kubectl get clusterroles
kubectl get clusterrolebinding

# Details
kubectl describe role pod-reader
kubectl describe rolebinding read-pods

# Check permissions
kubectl auth can-i create pods --namespace=default
kubectl auth can-i delete deployments --namespace=production

Testing Permissions

# Test as a user
kubectl get pods --as=developer1

# View a user's permissions
kubectl auth can-i --list --as=developer1 --namespace=development

---

Best Practices

1. Principle of Least Privilege

Grant only the necessary permissions.

2. Specific Roles

Create specific roles rather than using cluster-admin.

3. Namespace Isolation

Use namespaces to isolate environments.

4. Service Accounts

Use Service Accounts for applications rather than users.

5. Audit

Enable audit logging to trace access.

---

Summary

In this chapter, you learned:

RBAC: Role-Based Access Control
Roles: Permissions within a namespace
ClusterRoles: Permissions at the cluster level
RoleBindings: Bind roles to users/ServiceAccounts
Verbs: Authorized actions (get, list, create, update, delete, etc.)
Resources: Kubernetes objects (pods, services, deployments, etc.)
Predefined roles: cluster-admin, admin, edit, view
Best practices: Least privilege, specific roles, isolation

---

Next Steps

Chapter 9.2: Service Accounts
Chapter 9.3: Network Policies
Lab 9.1: Configuring RBAC for a User

---

Chapter created on: December 2024