Summary - RBAC
- Docker & Kubernetes course
- Advanced
- Lesson 48/70
- 5 min
Combine Role, Binding and ServiceAccount to write permissions.
Summary: RBAC
In this group:
- RBAC denies everything by default; permissions are additive.
- Role (namespace) and ClusterRole (cluster) are permission sets:
apiGroups,resources,verbs, optionalresourceNames. - RoleBinding and ClusterRoleBinding bind a role to a subject (User, Group, ServiceAccount); RoleBinding + ClusterRole applies in one namespace.
- A ServiceAccount is a pod identity; an app-specific SA with least privilege is given, and the token isn't mounted if not needed.
- Subresources (
pods/log,pods/exec) need separate permissions;"*"is avoided.auth can-itests.
kubectl auth can-i --list --as system:serviceaccount:dev:api -n devPractice Write the binding in YAML
Write a RoleBinding YAML: name ayse-pod-okuyucu, namespace dev; subject kind: User, name: ayse, apiGroup: rbac.authorization.k8s.io; roleRef kind: Role, name: pod-okuyucu, apiGroup: rbac.authorization.k8s.io.
Starter code
# buraya yazSample solution
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ayse-pod-okuyucu
namespace: dev
subjects:
- kind: User
name: ayse
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-okuyucu
apiGroup: rbac.authorization.k8s.ioExpected output
rolebinding.rbac.authorization.k8s.io/ayse-pod-okuyucu created $ kubectl auth can-i list pods -n dev --as ayse yes
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What is the shortest way to give a developer permission to modify most resources only in the dev namespace?
- A RoleBinding in dev granting the edit ClusterRole Correct answer
- A cluster-admin ClusterRoleBinding
- A separate Role for each resource
- Sharing the default ServiceAccount
Explanation: Binding the built-in role to the namespace is enough.
2 Turn off mounting the token into the pod.
Question
spec:
____: false
Answer
spec:
automountServiceAccountToken: falseExplanation: Pods that don't access the API don't mount the token.
3 Match.
| Term | Meaning |
|---|---|
Role |
Namespace permissions |
ClusterRole |
Cluster permissions |
RoleBinding |
Namespace binding |
ServiceAccount |
Pod identity |