Kubernetes RBAC

Kubernetes RBAC uses the rbac.authorization.k8s.io API Group, GA since Kubernetes 1.8 (Sep 2017)

https://kubernetes.io/docs/reference/access-authn-authz/rbac/

Commands

• kubectl create role
• kubectl create clusterrole
• kubectl create rolebinding
• kubectl create clusterrolebinding

• kubectl auth reconcile
• kubectl auth can-i

K8s Cluster roles

https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

• cluster-admin
• admin
• edit
• view (kubectl describe clusterrole view)

Review https://medium.com/codex/how-to-provide-access-to-aws-eks-for-sso-users-via-aws-sso-to-view-and-manage-the-cluster-17e2acfd6a35 for screenshoots of AWS EKS console depending of different roles.

Related: groups:, kubectl get clusterroles

Related terms

• cluster-read-only-role
• Kubernetes tokens
• Attribute-based access control (ABAC)
• Kubernetes service account: kubectl create serviceaccount
• CKA 1.23: Manage role based access control (RBAC)
• AWS Controllers for Kubernetes (ACK)
• Amazon EKS authorization
• Amazon EKS cluster endpoint (API server) access control
• kubernetes_role_v1, kubernetes_role_binding_v1
• Using RBAC Authorization

Activities

• Learn the differences between Role and ClusterRole: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole
• Certified Kubernetes Security Specialist (CKS)

News

• March 2017 Kubernetes 1.6

See also

• Kubernetes roles, kubectl get [ roles | clusterroles | clusterrolebindings ], kubectl create rolebinding, K8s Cluster roles, kind: Role
• kubectl auth [ can-i | reconcile ]
• Kubernetes RBAC kubectl auth, kubectl auth can-i, kubectl auth reconcile kubectl create [ role | clusterrole | clusterrolebinding | rolebinding | serviceaccount ], groups:, Kubernetes RBAC good practices, kube2iam, K8s Cluster roles, rbac.authorization.k8s.io, system:, kind: AuthorizationConfiguration, aws-auth for EKS, kind: Role, SelfSubjectReviews, Impersonation

https://www.mirantis.com/blog/whats-new-kubernetes-1-6-focus-stability/