Implementing Kubernetes RBAC in your cluster

by

Kubernetes Role-Based Access Control (RBAC) is a powerful mechanism to manage user permissions and control access to cluster resources. By assigning roles to users or groups, you can granularly define what actions they can perform.

Understanding Key Concepts

Roles: Define a set of permissions.
RoleBindings: Associate roles with users or groups.
ClusterRoles: Roles that apply to the entire cluster.
ClusterRoleBindings: Bind clusterRoles to users or groups.

RBAC Scenarios

Cluster Roles and ClusterRoleBindings: For permissions that apply to the entire cluster.
Aggregation: Combining multiple roles into a single role.
Conditional Access Control: Using labels to control access based on resource attributes.
Service Account Tokens: Issuing tokens for service accounts to authenticate with other services.

Best Practices

Least Privilege Principle: Grant only the necessary permissions.
Role-Based Separation of Duties: Prevent conflicts of interest.
Regular Reviews: Audit and update RBAC configurations.
Use Service Accounts: Avoid using admin credentials directly.
Leverage Tools: Use tools like kubectl auth view to visualize RBAC.

Step-by-Step Guide for Implementing RBAC in Kubernetes for Users

To implement RBAC (Role-Based Access Control) for different users in your Kubernetes cluster, you'll need to create roles or cluster roles, and then bind those roles to the specific users using RoleBindings or ClusterRoleBindings. Here's how you can do it step by step:

Step 1: Set Up Kubernetes Authentication for Linux Users

First, ensure that each Linux user has a corresponding Kubernetes user identity. In Kubernetes, users are not managed inside the cluster; instead, they are managed externally, often via client certificates or an external identity provider.

Option 1: Using Client Certificates

1. Generate a client certificate for each user: - For example, for a user named `alice`:

# openssl genrsa -out alice.key 2048

# openssl req -new -key alice.key -out alice.csr -subj "/CN=alice"

# openssl x509 -req -in alice.csr -CA /path/to/ca.crt -CAkey /path/to/ca.key -CAcreateserial - out alice.crt -days 365

- Now, `alice.crt` and `alice.key` are the client certificate and key for the user `alice`.

2. Configure Kubernetes to recognize these users:

- Users will authenticate to the Kubernetes API server using these certificates. Add the certificates to the kubeconfig:

# kubectl config set-credentials alice --client-certificate=/path/to/alice.crt --clientkey=/path/to/alice.key

# kubectl config set-context alice-context --cluster= -- namespace=default --user=alice

Option 2: Using an External Identity Provider

If your cluster is integrated with an identity provider (like OpenID Connect or LDAP), users can authenticate directly via their credentials, and you won't need to manually manage certificates.

Step 2: Create Roles or ClusterRoles
Define what actions each user should be allowed to perform.

  1. Example of a Role (namespace-specific):
    Create a role.yaml file

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: dev
name: developer-role
rules:

apiGroups: [“”]
resources: [“pods”, “services”]
verbs: [“get”, “list”, “create”, “update”, “delete”]
“`

2. Example of a ClusterRole (cluster-wide):
Create a clusterrole.yaml


apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cluster-admin-role
rules:

apiGroups: [""]
resources: ["pods", "nodes", "services"]
verbs: ["get", "list", "create", "update", "delete"]

Step 3: Create RoleBindings or ClusterRoleBindings

Bind the roles to the specific users.

  1. RoleBinding (for namespace-specific permissions):
    Create a rolebinding.yaml
    apiVersion: rbac.authorization.k8s.io/v1
    kind: RoleBinding
    metadata:
    name: bind-alice-to-developer-role
    namespace: dev
    subjects:

kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: developer-role
apiGroup: rbac.authorization.k8s.io

  1. ClusterRoleBinding (for cluster-wide permissions):
    Create a clusterrolebinding.yaml
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
    name: bind-alice-to-cluster-admin-role
    subjects:

- kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: cluster-admin-role
apiGroup: rbac.authorization.k8s.io

Step 4: Apply the RBAC Configuration
Apply the YAML files you created using kubectl:
kubectl apply -f role.yaml
kubectl apply -f rolebinding.yaml
kubectl apply -f clusterrole.yaml
kubectl apply -f clusterrolebinding.yaml

Step 5: Test User Access
You can test the access control by switching to the user's context:
kubectl config use-context alice-context
kubectl get pods -n dev

This command will either succeed or fail based on the permissions defined in the role.

Summary

  • Step 1: Set up Kubernetes authentication for your Linux users, typically using client certificates.
  • Step 2: Create Role or ClusterRole resources that define the allowed actions.
  • Step 3: Create RoleBinding or ClusterRoleBinding resources to associate users with
    roles.
  • Step 4: Apply the RBAC configurations.
  • Step 5: Test the access controls by using the configured Kubernetes context for each user.
    This approach allows you to control what each user can do within the cluster based on their roles.

Leave a Comment