Stop giving root access and start securing your Kubernetes clusters instead
summary
Shows how to stop handing out cluster-admin by using RBAC, service account tokens mounted in pods, and scoped Roles/RoleBindings to give just the permissions needed. Demo runs on a kind cluster with kubectl, curl and jq: extracts the JWT from /var/run/secrets, decodes it, uses the token plus the CA cert to call the API, and proves deleting the pod revokes that token. Builds a Role to patch/scale a single nginx Deployment, uses a ClusterRole view for discovery, and explains cert revocation limits and OIDC alternatives.
AI-written summary · about
chapters (6)
- 0:00Introduction and setup
- 3:55Authentication and authorization basics
- 9:35RBAC role and binding demo
- 18:25Custom service account permissions
- 26:17Summary and resources
- 27:43Q&A on credential revocation
related talks
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
45mBeyond cluster-admin: Getting Started with Kubernetes Users and Permissions
31mKubernetes RBAC Security: A Practical Overview
33mHow the Basics Of Kubernetes Auth Scale For Organizations
35mRBAC to the Future: Untangling Authorization in Kubernetes
41mKubernetes Auth and Access Control
54mUnderstanding and Mitigating Privilege Escalation Threats in Kubernetes
35mSmarter Kubernetes Access Control: A Simpler Approach to Auth