Challenge - RBAC
- Docker & Kubernetes course
- Advanced
- Lesson 69/70
- 5 min
Write a ServiceAccount and a RoleBinding.
Challenge: least privilege
A CI system should only be able to update the image of deployments in the magaza namespace and watch their status; it mustn't read Secrets or touch other namespaces. For this:
- The
ciServiceAccount - A Role granting only
get,list,watch,patchfor deployments - A RoleBinding binding the two
- Testing with
auth can-i
kubectl auth can-i patch deployments -n magaza --as system:serviceaccount:magaza:ci # yes
kubectl auth can-i get secrets -n magaza --as system:serviceaccount:magaza:ci # no
kubectl auth can-i patch deployments -n prod --as system:serviceaccount:magaza:ci # noPractice The role
Write a Role YAML: name ci-dagitici, namespace magaza; a single rule: apiGroups: ["apps"], resources: ["deployments"], verbs: ["get", "list", "watch", "patch"].
Starter code
# buraya yazSample solution
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: ci-dagitici
namespace: magaza
rules:
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch", "patch"]Expected output
role.rbac.authorization.k8s.io/ci-dagitici created
Practice Identity, binding and testing
Write four commands: create the ci ServiceAccount in magaza; create a RoleBinding ci-dagitici in magaza giving the ci-dagitici role to magaza:ci; query the permission to patch deployments in magaza as system:serviceaccount:magaza:ci; with the same identity, query the permission to get Secrets in magaza.
Starter code
# buraya yazSample solution
kubectl create serviceaccount ci -n magaza
kubectl create rolebinding ci-dagitici --role=ci-dagitici --serviceaccount=magaza:ci -n magaza
kubectl auth can-i patch deployments -n magaza --as system:serviceaccount:magaza:ci
kubectl auth can-i get secrets -n magaza --as system:serviceaccount:magaza:ciExpected output
serviceaccount/ci created rolebinding.rbac.authorization.k8s.io/ci-dagitici created yes no
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Which verb is needed for kubectl set image?
- patch (and get for reading) Correct answer
- create
- delete
- escalate
Explanation: set image patches the deployment.
2 Write the deployments' API group.
rules:
- apiGroups: [____]
resources: ["deployments"]rules:
- apiGroups: ["apps"]
resources: ["deployments"]Explanation: Deployment is in the apps group.
3 Match.
| Term | Meaning |
|---|---|
ci ServiceAccount |
CI identity |
Role |
Only magaza |
patch |
Updating the image |
secrets: no |
No access to secrets |