RBAC 101: Basics, Misconceptions, and the Real World
summary
Covers how Kubernetes RBAC composes: subjects (users, groups, serviceaccounts), Roles/ClusterRoles, and RoleBindings/ClusterRoleBindings; shows using cluster role aggregation to avoid repeating roles across 50+ namespaces, using Flux/gitops for declarative binding, and using impersonation for testing to assert "can I do X" before executing. Notes concrete limitations: cannot filter list/watch, resourceNames-only create requires server‑side apply, serviceaccounts aren’t cross‑cluster, and recommends Pinniped/Dex and bootstrap roles.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:06The challenge of access
- 3:40Understanding RBAC basics
- 7:16Authentication vs authorization
- 8:58Subjects and identities
- 12:23Defining roles and resources
- 15:37Role bindings and scope
- 18:51Granular access patterns
- 22:21Advanced RBAC features
- 25:56Demo: Impersonation
- 30:23Q&A and troubleshooting
- 33:46Implementation best practices
- 37:13Tools and recommendations
- 40:02Platform administration demo
- 47:30GitOps and culture
- 52:24Final Q&A
related talks
33mHow the Basics Of Kubernetes Auth Scale For Organizations
35mRBAC to the Future: Untangling Authorization in Kubernetes
40mEffective RBAC
31mKubernetes RBAC Security: A Practical Overview
27mI Can RBAC, and So Can You!
35mManaging RBAC Cross Multiple Kubernetes Clusters
38mMulti-Tenancy Support & Security Modeling with RBAC and Namespaces
26mGetting Permission or Asking Forgiveness?