RBAC

Kubernetes Role-Based Access Control (RBAC) is a foundational mechanism for enforcing granular access policies across clusters. By defining roles and permissions, administrators can restrict user and service account interactions with cluster resources, ensuring compliance with security principles like least privilege and separation of duties.

---

Core Concepts

RBAC in Kubernetes revolves around four key components:
1. Roles and ClusterRoles: Define permissions (e.g., get, list, create) for specific resources.
- Role is namespace-scoped.
- ClusterRole applies to the entire cluster.
2. RoleBindings and ClusterRoleBindings: Link roles to users, groups, or service accounts.
- RoleBinding ties a Role to a subject within a namespace.
- ClusterRoleBinding associates a ClusterRole with a subject across the cluster.
3. ServiceAccounts: Default accounts for pods, often used as the target of RBAC policies.

---

Implementation

1. Define Roles

Create a Role to grant permissions within a namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

2. Bind Roles to Users

Assign the role to a user or service account:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: alice
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

3. Cluster-Wide Access

For cluster-wide permissions, use ClusterRole and ClusterRoleBinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployment-admin
rules:
- apiGroups: [""]
  resources: ["deployments"]
  verbs: ["get", "list", "create", "update", "delete"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-deployments
subjects:
- kind: ServiceAccount
  name: my-serviceaccount
  namespace: default
roleRef:
  kind: ClusterRole
  name: deployment-admin

---

Best Practices

• Principle of Least Privilege: Grant only the permissions required for a task.
• Use ServiceAccounts: Avoid exposing user credentials; bind roles to service accounts used by applications.
• Separate Roles and Bindings: Decouple role definitions from bindings to enable flexible reuse.
• Audit Regularly: Use tools like kube-bench to validate compliance with security policies.
• Test Before Deployment: Validate RBAC rules in staging environments to prevent unintended access.

---

Key takeaways

• RBAC enables granular access control by defining roles and binding them to users/service accounts.
• Use Role/ClusterRole for permissions and RoleBinding/ClusterRoleBinding to enforce access.
• Prioritize least privilege and audit policies regularly to maintain security.
• ServiceAccounts are ideal for application-level RBAC to avoid exposing user credentials.
• Combine RBAC with network policies and secrets management for a holistic security strategy.