K8s - User and Groups
But, K8s has something called "Service Account".
When K8s is installed from scratch, every namespace has "default" service account and it has admin access to perform actions.
It is not practically possible to use "default" service account for every actions. From security point of view, we need to give fine grained and required access.
K8s has 2 important things in the space of "Access Management".
Role and RoleBinding [Namespace Scoped]
Role: Create a role with actions allowed actions on the resources.
Let's say I want to create a readonly role. Using the role users can only view the resource and cannot perform actions like create, modify, delete.
Rolebinding: Attaching the role to a user, group and service account is called "Role Binding".
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default
name: pod-reader
rules:
- apiGroups: [""] # "" indicates the core API group
resources: ["pods"]
verbs: ["get", "watch", "list"]
The above role called "pod-reader" allows actions like ["get", "watch", "list"] on the resource "pod".
Now, let's attach this role to some users and group via Role Binding.
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
namespace: default
subjects:
- kind: User
name: jane
apiGroup: rbac.authorization.k8s.io
- kind: User
name: smith
apiGroup: rbac.authorization.k8s.io
- kind: User
name: paul
apiGroup: rbac.authorization.k8s.io
- kind: Group
name: readonly-group
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Now, we can see the role "pod-reader" is attached to the users "jane", "smith", "paul" and group "readonly-group".
K8s will not validate if the above mentioned user, group exist. Because, K8s does not have any resources like users and group.
Now, how do I validate if the user "jane" can perform list operation or not?
Comments
Post a Comment