Challenge - RBAC

Write a ServiceAccount and a RoleBinding.

Challenge: least privilege

A CI system should only be able to update the image of deployments in the magaza namespace and watch their status; it mustn't read Secrets or touch other namespaces. For this:

The ci ServiceAccount
A Role granting only get, list, watch, patch for deployments
A RoleBinding binding the two
Testing with auth can-i

kubectl auth can-i patch deployments -n magaza --as system:serviceaccount:magaza:ci   # yes
kubectl auth can-i get secrets -n magaza --as system:serviceaccount:magaza:ci          # no
kubectl auth can-i patch deployments -n prod --as system:serviceaccount:magaza:ci     # no

Exercise The role

Write a Role YAML: name ci-dagitici, namespace magaza; a single rule: apiGroups: ["apps"], resources: ["deployments"], verbs: ["get", "list", "watch", "patch"].

Show example solution

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ci-dagitici
  namespace: magaza
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "patch"]

Exercise Identity, binding and testing

Write four commands: create the ci ServiceAccount in magaza; create a RoleBinding ci-dagitici in magaza giving the ci-dagitici role to magaza:ci; query the permission to patch deployments in magaza as system:serviceaccount:magaza:ci; with the same identity, query the permission to get Secrets in magaza.

Show example solution

kubectl create serviceaccount ci -n magaza
kubectl create rolebinding ci-dagitici --role=ci-dagitici --serviceaccount=magaza:ci -n magaza
kubectl auth can-i patch deployments -n magaza --as system:serviceaccount:magaza:ci
kubectl auth can-i get secrets -n magaza --as system:serviceaccount:magaza:ci

Test yourself

Which verb is needed for kubectl set image?
- patch (and get for reading)
- create
- delete
- escalate
Show answer

patch (and get for reading) — set image patches the deployment.

Write the deployments' API group.

rules:
  - apiGroups: [____]
    resources: ["deployments"]

Show answer

rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]

Match.

ci ServiceAccount

CI identity
Role

Only magaza
patch

Updating the image
secrets: no

No access to secrets

Next lesson: Challenge - Advanced project

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies