Lightning Talk: I Got your RBAC - kube-rbac-proxy - Frederic Branczyk, CoreOS (Any Skill Level)
summary
A tiny reverse proxy called kube-rbac-proxy sits in front of an app and uses Kubernetes TokenReview and SubjectAccessReview calls to authenticate service account tokens and check RBAC before forwarding metrics traffic. Demo shows unauthenticated requests rejected, authenticated tokens without RBAC get forbidden, and granting the services/proxy subresource to Prometheus allows successful scraping. Built as a sidecar and configured via ConfigMap it works end to end and next steps are switching to the TokenRequest flow to avoid token impersonation and add OIDC machine/user auth.
AI-written summary · about
chapters (4)
related talks
35mRBAC to the Future: Untangling Authorization in Kubernetes
59mKubernetes access control in the enterprise
31mKubernetes RBAC Security: A Practical Overview
56mRBAC 101: Basics, Misconceptions, and the Real World
32mStop giving root access and start securing your Kubernetes clusters instead
33mHow the Basics Of Kubernetes Auth Scale For Organizations
35mManaging RBAC Cross Multiple Kubernetes Clusters
35mSmarter Kubernetes Access Control: A Simpler Approach to Auth