Effective RBAC
summary
RBAC v1 in Kubernetes 1.8 maps requests to roles and bindings: use clusterrole/rolebinding (global vs namespaced) to define and grant permissions, and run the API server with the Node authorizer plus RBAC for node isolation. Generate least-privilege roles from structured audit logs using audit-to-rbac to auto-produce role YAML (author reports ~97% coverage), apply with kubectl, and use aggregated roles (Kubernetes 1.9) to fold custom-resource permissions into admin/edit/view.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:11A Short Story
- 3:58Request Handling
- 5:17RBAC Overview
- 11:40Cluster Setup
- 16:54Applying Policies
- 21:00Building Custom Roles
- 28:40Aggregated Roles
related talks
56mRBAC 101: Basics, Misconceptions, and the Real World
35mRBAC to the Future: Untangling Authorization in Kubernetes
33mHow the Basics Of Kubernetes Auth Scale For Organizations
31mKubernetes RBAC Security: A Practical Overview
35mManaging RBAC Cross Multiple Kubernetes Clusters
26mGetting Permission or Asking Forgiveness?
27mI Can RBAC, and So Can You!
34mFine-Grained Permissions in K8s: What’s Missing, and How to Fix That