Tous les labs

Build least-privilege RBAC

Intermediate ~24 mink8s

ServiceAccount auditor in namespace finance may get, list and watch Pods and read pod logs, but may not modify workloads.

Simulateur déterministe — tape une commande (kubectl get pods -A) pour commencer.
student@kubelab:~$
Objectifs
  • Create ServiceAccount auditor
  • Create Role pod-auditor for pods and pods/log
  • Create RoleBinding in finance
  • Verify allowed and denied actions
Étapes suggérées
  1. pods/log is a subresource.
  2. Keep the binding namespaced.
  3. Use --as to test.
Indices
Voir la solution
kubectl create serviceaccount auditor -n finance
kubectl create role pod-auditor -n finance --verb=get,list,watch --resource=pods,pods/log
kubectl create rolebinding auditor -n finance --role=pod-auditor --serviceaccount=finance:auditor
kubectl auth can-i delete pod -n finance --as=system:serviceaccount:finance:auditor