RBAC to the Future: Untangling Authorization in Kubernetes
summary
Explains how Kubernetes RBAC actually enforces identity and authorization, with concrete failures and fixes: a default service account + cluster-admin binding lets any pod replay a token and own the cluster; a list vs curl secret leakage demonstrates that listing can expose secret data depending on client; audit logs include allow/deny and reason for every API request; practical tooling includes Open Policy Agent rules, audit-to-rbac, and visualization/aggregation approaches to find and remove wildcard "" permissions* and build least-privilege policies.
AI-written summary · about
chapters (12)
- 0:00Introduction to K8s RBAC
- 1:03Identity and API flow
- 4:46RBAC architecture basics
- 7:09Implementing RBAC policies
- 10:17Default cluster roles
- 11:31Common RBAC security risks
- 15:01Visualization and auditing
- 17:37Secret list gotcha
- 21:17Kubernetes audit logging
- 24:02Authentication mechanics
- 26:50Hardening strategies
- 30:45Q&A and conclusion
related talks
31mKubernetes RBAC Security: A Practical Overview
33mHow the Basics Of Kubernetes Auth Scale For Organizations
56mRBAC 101: Basics, Misconceptions, and the Real World
40mEffective RBAC
26mGetting Permission or Asking Forgiveness?
32mStop giving root access and start securing your Kubernetes clusters instead
35mSmarter Kubernetes Access Control: A Simpler Approach to Auth
49mCompromising Kubernetes Cluster by Exploiting RBAC Permissions