Smarter Kubernetes Access Control: A Simpler Approach to Auth
summary
Shows concrete authorisation fixes: use kubectl auth can-i to test scoped permissions (impersonation requires extra rights), use kubectl who-can (Aqua) to list principals for an action, and use rbac-lookup to print cluster RBAC and GKE IAM. Demonstrates an operator, rbac-manager, that reduces rolebinding YAML by ~30%, auto-creates/updates (deletes+recreates immutable roleRefs) and reliably revokes access, and supports namespace label selectors for ephemeral envs; demo proves create, update and revoke workflows work.
AI-written summary · about
chapters (7)
- 0:00Kubernetes access control
- 1:04Kubernetes authorization challenges
- 4:57RBAC basics
- 8:33Who has access in Kubernetes
- 16:32Managing RBAC
- 19:06RBAC Manager tool
- 27:13Open-source tools & Q&A
related talks
33mHow the Basics Of Kubernetes Auth Scale For Organizations
35mRBAC to the Future: Untangling Authorization in Kubernetes
31mKubernetes RBAC Security: A Practical Overview
26mGetting Permission or Asking Forgiveness?
32mStop giving root access and start securing your Kubernetes clusters instead
59mKubernetes access control in the enterprise
49mCompromising Kubernetes Cluster by Exploiting RBAC Permissions
41mKubernetes Auth and Access Control