User RBAC on Kubernetes Simplified

  • user accounts are for humans (e.g. k8s admins) that need access to the Kubernetes API
  • service accounts are for applications (e.g. pods) that need access to the Kubernetes API

A simple use case

Step 1. Install OpenSSL and run scripts to make your life easier

https://github.com/airwavetechio/kubernetes-rbac
kubectl cluster-info
choco install openssl.light
Make sure you reboot after you install OpenSSL
kubernetes-rbac\k8s_usergen.bat <username> <group> https://SERVER_IP:PORT
apt-get install openssl
./kubernetes-rbac/k8s_usergen.sh <username> <group> https://<SERVER_IP>:<PORT>
WIndows file output
Linux file output

Step 2. Understanding Users, Groups, Role Bindings

kubectl apply -f namespace.json
Excerpt from https://raw.githubusercontent.com/airwavetechio/kubernetes-rbac/master/rbac-user-rolebinding.yml
kubectl apply -f rbac-user-rolebinding.yml

Service Account (User/Group) > Role Binding > Role

Step 3. Configure your new client

You can see how getting pods works, but getting the namespaces doesn’t.
kubectl get pods
kubectl get ns
Generate a new user “tony” that’s in the “superusers” group
Give the file to Tony so he can have access as

Step 4. ClusterRoles and ClusterRoleBindings

kubectl get pods -n kube-system
Excerpt from https://raw.githubusercontent.com/airwavetechio/kubernetes-rbac/master/rbac-user-clusterrolebinding.yml
kubectl apply -f rbac-user-clusterrolebinding.yml

Step 5. Clean Up

kubectl delete -f rbac-user-clusterrolebinding.yml
kubectl delete -f rbac-user-rolebinding.yml
kubectl delete -f namespace.json

--

--

--

Helping you build the hardest parts of your Stack

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

Lucid Software — Visualizing the Future

How to Efficiently Re-Partition Spark DataFrames

Tutorial Fuzzy Logic Mamdani for Arduino

Tutorial Fuzzy Logic Mamdani for Arduino

[LeetCode]#1380. Lucky Numbers in a Matrix

Using docker inside WSL (

Designing Feed Relationships with Graph Databases (Full Stack TigerGraph Part 2)

Ask your French teacher THIS magical question…

Django framework for web development

Django framework for web development

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
AirwaveTech

AirwaveTech

Helping you build the hardest parts of your Stack

More from Medium

Exploring Kubernetes

The Architecture of a Kubernetes Cluster

Top 10 Reason to use VMware Tanzu as K8S platform