Security - Role Based Access Control

Question 1

How do we link a user to a role?

Answer 1

via another object: RoleBinding .yaml
~~~
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: devuser-developer-binding
(namespaces if you want to limit, what it is applied to)
subjects:
- kind: User
name: dev-user
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: developer
apiGroup: rbac.authorization.k8s.io
~~~
- create via kubectl
- falls under namespaces, applies to current namespace if not specified differently

Question 1

How do we create a role?

Answer 1

role.yaml:
~~~
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: developer
rules:
- apiGroups: [””]
resources: [“pods”]
verbs: [“list”, “get”, “create”, “update”, “delete”]
- apiGroups: [””]
resources: [“ConfigMap”]
verbs: [“create”]
~~~

Question 2

How can you check whether or not you have access to a certain object + verb?

Answer 2

kubectl auth can-i create deployments

Question 3

How can you (as an admin) whether a certain user can do specific things?

Answer 3

kubectl auth can-i create pods –as dev-user

Question 4

Where can you find the details about the kube-apiserver?

Answer 4

/etc/kubernetes/manifest/kube-apiserver.yaml

ps -aux | grep authorization

Question 4

With what command can you imperatively create a role binding?

Answer 4

k create rolebinding dev-user-binding –role=developer –user=dev-user

Question 5

What are Cluster Roles? Clusterrolebindings?

Answer 5

• used for access to cluster scoped resources
• beside that just like roles and rolebindings

Question 6

How can resources be differentiated in terms of scope?

Answer 6

Resources can be
- namespaced (pods, jobs, deployments, services, roles, …)
- cluster scoped (nodes, PV, clusterroles, namespaces, clusterrolebindings, …)

Question 7

What is the difference between namespaced and cluster-scoped resouces?

Answer 7

Namespaced resources adhere to a certain, specified namespace. If not specified to the default namespace.

Cluster-scoped resources are cluster-wide available

Question 8

How does a Clusterrole yaml look like?

Answer 8

like a role-yaml just with kind=ClusterRole

Question 9

Is it possible to define ClusterRoles for namespaced resources?

Answer 9

Yes, the access is then across all namespaces