Lab 27 - RBAC

Goal: give Jane exactly what she needs in dev - and nothing else. Chapter: RBAC and least privilege

Requires user jane from Lab 26.

# 1 - something to look at
kubectl create deploy web --image nginx:1.27 --replicas 2 -n dev
kubectl --context jane get pods               # Forbidden

# 2 - a Role: read Pods and their logs
kubectl create role pod-reader -n dev \
  --verb=get,list,watch --resource=pods,pods/log
kubectl create rolebinding jane-pod-reader -n dev \
  --role=pod-reader --user=jane
kubectl --context jane get pods               # works
kubectl --context jane logs deploy/web --tail=2
kubectl --context jane delete pod --all       # Forbidden
kubectl --context jane get deploy             # Forbidden - only pods

# 3 - the whole list, from the admin side
kubectl auth can-i --list -n dev --as jane

Groups and built-in roles

# 4 - dev-team may edit in dev (built-in ClusterRole "edit", scoped by RoleBinding)
kubectl create rolebinding dev-team-edit -n dev --clusterrole=edit --group=dev-team
kubectl --context jane get deploy             # works now - via her group
kubectl --context jane scale deploy web --replicas 3
kubectl --context jane get secrets            # works - edit includes secrets!
kubectl --context jane get pods -n default    # Forbidden - other namespace

edit includes reading Secrets and pods/exec. Convenient - and a lot of power. Is that what the team needs?

# 5 - least privilege: replace edit by a custom role
kubectl delete rolebinding dev-team-edit -n dev
cat > ~/deployer.yaml <<'YAML'
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployer
  namespace: dev
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create", "update", "patch"]
  - apiGroups: ["apps"]
    resources: ["deployments/scale"]
    verbs: ["update", "patch"]
  - apiGroups: [""]
    resources: ["pods", "pods/log", "services", "configmaps"]
    verbs: ["get", "list", "watch"]
YAML
kubectl apply -f ~/deployer.yaml
kubectl create rolebinding dev-team-deployer -n dev --role=deployer --group=dev-team
kubectl --context jane scale deploy web --replicas 2      # works
kubectl --context jane get secrets                        # Forbidden
kubectl --context jane exec deploy/web -- ls              # Forbidden

Discovery

Infodiscover

Task A. Jane may delete Deployments but only the one named web.

Show one answer

kubectl create role delete-web -n dev --verb=delete --resource=deployments --resource-name=web
kubectl create rolebinding jane-delete-web -n dev --role=delete-web --user=jane
kubectl auth can-i delete deploy/web -n dev --as jane      # yes
kubectl auth can-i delete deploy/other -n dev --as jane    # no

Task B. Who in the cluster may read Secrets in dev? List the bindings that grant it.

Show one answer

kubectl get rolebindings,clusterrolebindings -A -o wide | grep -E 'edit|admin|cluster-admin'
kubectl auth can-i get secrets -n dev --as jane --as-group dev-team

There is no built-in “who can” command - the kubectl who-can plugin (krew) answers it.

Task C. Give the group auditors read-only access to all namespaces.

Show one answer

kubectl create clusterrolebinding auditors-view --clusterrole=view --group=auditors
kubectl auth can-i list deploy -A --as x --as-group auditors      # yes
kubectl auth can-i get secrets -A --as x --as-group auditors      # no - view excludes secrets

Clean up

kubectl delete clusterrolebinding auditors-view --ignore-not-found

Keep namespace dev and Jane - Lab 28 and 30 use dev.