RBAC Flashcards
What subjects are there in kubernetes?
Users and groups, Service accounts
What command creates a service account?
kubectl create serviceaccount $SA_NAME
What gets created along with service accounts?
Nothing, before kubernetes 1.24 service accounts would automatically create a secret. Now the secret can either be created manually with “kubectl create token (sa name)” or by specifying a service account in a pod yaml file specs.
Where can you find the ca.crt and ca.key files for the kubernetes certificate authoraty
/etc/kubernetes/pki
What are the default roles?
cluster-admin - has access to everything
admin - has access to everything in a namespace
edit - Has access to all resources except roles and rolebindings in a namespace
view - has access to all resources except roles, rolebindings and secrets in a namespace
What command creates a role with list,get and watch access to pods deployments and services?
kubectl create role a-role –verb=list,get,watch –resource=pods,deployments,services
What command creates a role binding that bind a-role and johndoe
kubectl create rolebinding a-rolebinding –role=a-role –user=johndoe
Can a clusterrole aggregate existing clusterroles rules, how is the yaml file syntax for that?
apiVersion: rbac.authorization.k8s.io/v1
kind:ClusterRole
metadata:
name: example
aggregationRule:
clusterRoleSelectors:
- matchLabels:
rbac-pod-list: “true”
- matchLabels:
rbac-service-delete: “true
rules: []
How can you check the if a user johndoe can list pods?
kubectl auth can-i (verb) (resource) –as (subject)
kubectl auth can-i list pods –as johndoe
How can you get the secret token value of serviceaccount a-sa?
This is done in 3 steps:
1st get the secret name associated with the service account
Secretname =$(k get sa a-sa -o jsonpath=”{.secrets[0].name}”)
2. Then get the secret value
Secretvalue=$(k get secret $secretname -o jsonpath=”{.data.token}”)
3rd decode the value
Echo $secretvalue | base64 –decode
How can you view the contexts?
kubectl config get-contexts
What is the difference between the following commands:
1 - “k create rolebinding pipeline-binding1 –serviceaccount ns1:pipeline –clusterrole pipeline-role”
2 - “k -n ns1 create rolebinding pipeline-binding1 –serviceaccount ns1:pipeline –clusterrole pipeline-role”
The first command allows the permissions of cluster role pipeline-role to be done by sa ns1:pipeline on the default namespace. The second command does the same but on the ns1 namespace.
