What is RBAC?
- Docker & Kubernetes course
- Advanced
- Lesson 43/70
- 4 min
Learn the Role-Based Access Control concept.
What is RBAC?
RBAC (Role-Based Access Control) determines who (user, group, ServiceAccount) can perform which operations on which resources in the Kubernetes API. By default everything is denied; permissions are granted explicitly. There are four objects:
- Role / ClusterRole: a set of permissions (what can be done).
- RoleBinding / ClusterRoleBinding: binds the permission to a subject (who can do it).
$ kubectl auth can-i delete pods -n prod --as ayse
no
$ kubectl auth can-i list pods -n dev --as ayse
yesauth can-i
kubectl auth can-i asks whether an operation can be done. --as lets you ask on behalf of another user or ServiceAccount (this also requires permission); --list lists all permissions:
kubectl auth can-i create deployments -n dev
kubectl auth can-i get secrets --as system:serviceaccount:dev:api -n dev
kubectl auth can-i --list -n dev --as aysePractice Query permissions
Write three commands: can you create deployments in the dev namespace; can ayse delete pods in prod; list all of ayse's permissions in dev.
Starter code
# buraya yazSample solution
kubectl auth can-i create deployments -n dev
kubectl auth can-i delete pods -n prod --as ayse
kubectl auth can-i --list -n dev --as ayseExpected output
yes no Resources Non-Resource URLs Resource Names Verbs pods [] [] [get list watch] pods/log [] [] [get list watch]
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 In RBAC, what is the default outcome for an operation without a permission?
- The admin is asked
- It's denied; RBAC only adds permissions, there are no deny rules Correct answer
- It's allowed
- It's allowed with a warning
Explanation: RBAC is additive: the union of permissions applies.
2 Ask about a permission on behalf of another user.
kubectl auth can-i delete pods -n prod ____ aysekubectl auth can-i delete pods -n prod --as ayseExplanation: --as asks with impersonation.
3 Match.
| Term | Meaning |
|---|---|
Role |
What can be done |
RoleBinding |
Who can do it |
auth can-i |
Permission query |
default |
Deny |