↓ Skip to main content
Samarthya
Samarthya
Kubernetes

K8S RBAC

·2 mins
Kubernetes Technical K8s Rbac
Table of Contents

What?
#

  • Role Based Access Control(s) is a way of regulating access to entities like storage, network etc.
  • RBAC authorization uses rbac.authorization.k8s.io API group.

API Objects
#

There are 4 kind of kubernetes object

Permissions are always additive.

Role
#

Role allows you to set permissions within a particular namespace.

When you define a Role you have must specify the namespace it belongs to.

ClusterRole
#

A ClusterRole can be used to grant the same permissions as a Role. It a non name-space bound resource & has several uses

  1. Define permissions on namespaced resources and be granted within individual namespace(s)
  2. Define permissions on namespaced resources and be granted across all namespaces
  3. Define permissions on cluster-scoped resources

RoleBinding
#

A role binding grants the permissions defined in a role to a user or set of users. It uses a list of subjects (users, groups, or service accounts), and a reference to the role being granted.

A RoleBinding grants permissions within a specific namespace whereas a ClusterRoleBinding grants that access cluster-wide.

The name of a RoleBinding or ClusterRoleBinding object must be a valid path segment name. — Official API documentation

ClusterRoleBinding
#

To grant permissions across a whole cluster, you can use a ClusterRoleBinding.

After you create a binding, you cannot change the Role or ClusterRole that it refers to. If you try to change a binding’s roleRef, you get a validation error. If you do want to change the roleRef for a binding, you need to remove the binding object and create a replacement.

Author
Samarthya
Engineer, learner, tinkerer. This is my trophy shelf of everyday work and leisure.

Related

CALICO CNI failures

CALICO CNI failures

·2 mins
Docker Kubernetes Technical Calico Cni Errors
In my cluster things went haywire all of a sudden without a proper showcase, I tried multiple things but it was just not working. Specifically my core-dns and calico-kube-controllers were not coming up and were constantly showing not ready and CrashLoop respectively
Secrets

Secrets

·4 mins
Technical K8s Secrets
To manage sensitive information you create secrets k create secret --help Create a secret using specified subcommand. Available Commands: docker-registry Create a secret for use with a Docker registry generic Create a secret from a local file, directory or literal value tls Create a TLS secret Usage: kubectl create secret [flags] [options] Use "kubectl <command> --help" for more information about a given command. Use "kubectl options" for a list of global command-line options (applies to all commands). type specifies the type of secret you are creating (options are as shown above). As I need to create only key value pairs for my dummy secret file I need to know a way of how to facilitate that, and the option -h helped me there
Pod & Volume: K8S

Pod & Volume: K8S

·1 min
Docker Technical K8s Pv Pvc
Everything in the same file apiVersion: v1 kind: Pod metadata: name: redispod spec: containers: - image: redis name: redisdb volumeMounts: - name: redis-data mountPath: /data ports: - containerPort: 6379 protocol: TCP volumes: - name: redis-data persistentVolumeClaim: claimName: redisdb-pvc --- apiVersion: v1 kind: PersistentVolume metadata: name: redis-pv spec: storageClassName: "" capacity: storage: 1Gi accessModes: - ReadWriteOnce hostPath: path: "/mnt/data" --- apiVersion: v1 kind: PersistentVolumeClaim metadata: name: redisdb-pvc spec: storageClassName: "" accessModes: - ReadWriteOnce resources: requests: storage: 1Gi If you deploy you will get something like