RBAC Fundamentals in Kubernetes

1. Introduction

Role-Based Access Control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within an enterprise. In Kubernetes, RBAC is essential for managing permissions and ensuring that users can only perform actions they are authorized to perform.

2. Key Concepts

Key Definitions

Role: Defines a set of permissions. Roles can be assigned to users or groups to give them access to certain resources.
ClusterRole: Similar to a Role, but the permissions apply across the entire cluster rather than within a specific namespace.
RoleBinding: Associates a Role with a user or a set of users within a specific namespace.
ClusterRoleBinding: Associates a ClusterRole with a user or set of users across the whole cluster.

3. RBAC Resources

In Kubernetes, RBAC is managed through the following resources:

Roles
ClusterRoles
RoleBindings
ClusterRoleBindings

4. Step-by-Step Guide

Here’s how to set up RBAC in Kubernetes:

4.1 Create a Role

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: example-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

4.2 Create a RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: example-rolebinding
  namespace: default
subjects:
- kind: User
  name: example-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: example-role
  apiGroup: rbac.authorization.k8s.io

4.3 Apply the Configuration

Use the following command to apply your Role and RoleBinding:

kubectl apply -f role.yaml
kubectl apply -f rolebinding.yaml

5. Best Practices

Important: Always follow the principle of least privilege when assigning roles in your Kubernetes cluster.

Use ClusterRoles for cluster-wide permissions.
Regularly review and audit roles and bindings.
Limit the use of wildcard permissions in RBAC policies.
Consider using namespaces to isolate resources and permissions.

6. FAQ

What is the difference between Role and ClusterRole?

A Role defines permissions within a specific namespace, while a ClusterRole defines permissions across the entire cluster.

Can a user have multiple roles?

Yes, a user can be bound to multiple roles or ClusterRoles, allowing for more granular permissions.

How do I troubleshoot RBAC issues?

Check the roles and bindings using kubectl get roles and kubectl get rolebindings. Use kubectl auth can-i to verify permissions.

7. RBAC Workflow

graph TD;
            A[User] --> B{Request Access}
            B -->|Yes| C[Check Role]
            C --> D[Grant Access]
            B -->|No| E[Access Denied]