Managing RBAC Cross Multiple Kubernetes Clusters

on YouTube ↗35m

" summary

Rancher implements a Kubernetes-native authn/authz layer using CRDs and custom controllers to manage users, groups and permissions across many clusters, with one central auth proxy that performs service-account impersonation to call member clusters. It adds a global role above cluster roles and a project grouping CRD that bundles namespaces so RBAC, PodSecurity and NetworkPolicy inherit automatically; roles and bindings are created/removed by controllers on add/remove events, and demos show cluster import, GitHub/LDAP/AD integration and live propagation working end-to-end.

AI-written summary · about

" chapters (37)

1. 0:00Introduction
2. 0:48When do you need multiple Kubernetes clusters
3. 1:02History of infrastructure
4. 2:05Kubernetes as a commodity
5. 2:36Multiple Kubernetes clusters
6. 2:47Use cases of multiple Kubernetes clusters
7. 5:15Kubernetes cloud types
8. 6:26Challenges
9. 7:21Missing Puzzle Piece
10. 7:39Authentication Authorization
11. 8:42Custom Controller Definition
12. 9:23Native Application Definition
13. 10:04Bonus
14. 10:25Overson
15. 10:59Rancher
16. 11:35Authentication with Rancher
17. 12:19Flow
18. 14:58RBAC Global Role
19. 15:35Project Role
20. 16:15Project Concept
21. 16:34Project Controller
22. 17:14Network Access
23. 17:32Part Security Policy
24. 18:35Live Demo
25. 18:51Launching Rancher
26. 21:17Importing clusters into Rancher
27. 21:43Running custom import
28. 21:56Testing custom import
29. 23:01Local setup
30. 23:14Authentication provider
31. 23:49Authentication rules
32. 24:16How to access your cluster
33. 24:33Cubectl
34. 25:09Roles
35. 26:27Global View
36. 26:47Project View
37. 28:18Questions

" related talks

• 59mKubernetes access control in the enterpriseJan Bruder · DevOpsCon Spring 2019
• 33mHow the Basics Of Kubernetes Auth Scale For OrganizationsLeigh Capili · KubeCon + CloudNativeCon North America 2022
• 40mEffective RBACJordan Liggitt · KubeCon + CloudNativeCon North America 2017
• 56mRBAC 101: Basics, Misconceptions, and the Real WorldLeigh Capili · KCD Los Angeles 2023
• 31mKubernetes RBAC Security: A Practical OverviewCarol Valencia · KCD Guatemala 2023
• 35mRBAC to the Future: Untangling Authorization in KubernetesJimmy Mesta · NDC Security 2023
• 30mKubernetes RBAC at scale without losing your sanityKevin Gimbel · ContainerDays Hamburg 2026
• 38mMulti-Tenancy Support & Security Modeling with RBAC and NamespacesFred Vong, Michael Y. Chen · KubeCon + CloudNativeCon North America 2017