Beyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
summary
Shows how to provision users with TLS certs via OpenSSL and kubeadm CA files under /etc/kubernetes/pki for self‑hosted clusters and via the CSR API for managed clusters, and how to use OIDC or Vault. Demonstrates using service account tokens (JWTs, viewable at jwt.io), shows tokens bound to pods by default (recent Kubernetes, ≈1.21+) so revoked when pod dies, and builds concrete RBAC artifacts: a role and role binding to grant get/list pods and a scoped role for patching deployment/scale, all exercised with kubectl, kubens, and nginx demo pods.
AI-written summary · about
chapters (11)
- 0:00Start
- 0:43AUTHENTICATION & AUTHORIZATION
- 1:20PROVISIONING USERS
- 4:18CERTIFICATES - THROUGH THE CSR API (1)
- 6:15TOKENS: OIDC
- 7:36TOKENS: SERVICE ACCOUNT
- 10:59Example Service Account
- 11:40Example RoleBinding
- 11:51RBAC AUDITING
- 32:16DEMO: FACTORY ROLES
- 32:29DEMO: SCALER
related talks
45mBeyond cluster-admin: Getting Started with Kubernetes Users and Permissions
32mStop giving root access and start securing your Kubernetes clusters instead
33mHow the Basics Of Kubernetes Auth Scale For Organizations
41mKubernetes Auth and Access Control
35mRBAC to the Future: Untangling Authorization in Kubernetes
25mMastering K8s Security
31mKubernetes RBAC Security: A Practical Overview
01h 59mBuilding Secure Kubernetes Clusters with Identity Management