Fine-Grained Permissions in K8s: What’s Missing, and How to Fix That
summary
Kubernetes RBAC is too coarse to restrict actions inside a namespace, and namespaces are not security boundaries, so fine-grained control uses admission webhooks to validate or mutate requests, the Open Policy Agent (with Gatekeeper) to centralize allow/deny logic and return JSON patches, and network policies (Calico or service-mesh controls) to stop the default flat pod network. Custom API gateways work but add code and operational burden; the object-level permission idea is rejected in favor of webhooks + RBAC and smaller namespaces.
AI-written summary · about
chapters (5)
- 0:00Start
- 22:41Kubernetes' design priority is extensibility, not out-of-the-box usability. This includes security considerations.
- 23:09Put individual sets of resources, like a service/project in their own namespaces.
- 23:38Use RBAC to restrict access to reasonable as-needed access. Prefer too-broad over painfully granular.
- 24:05Use policy tools like webhooks or OPA to provide narrow restrictions to resources, beyond RBAC granularity.
related talks
35mRBAC to the Future: Untangling Authorization in Kubernetes
26mGetting Permission or Asking Forgiveness?
40mEffective RBAC
31mKubernetes RBAC Security: A Practical Overview
33mHow the Basics Of Kubernetes Auth Scale For Organizations
32mFine-Grained Policies RBAC with NGAC
25mMastering K8s Security
16mDistributed application level RBAC with OPA