Skip to main content

Lab 9.1 - Creating Roles and RoleBindings

Lab Objectives​

By the end of this lab, you will be able to:

  • Understand the concept of RBAC in Kubernetes.
  • Create a Role with specific permissions.
  • Create a RoleBinding to bind a user to a Role.
  • Test permissions with kubectl auth can-i.
  • Understand the difference between Role and ClusterRole.

Estimated Duration​

45-60 minutes

Prerequisites​

  • kubectl installed and configured.
  • Local Kubernetes cluster running.
  • Knowledge of RBAC (Chapter 9.1).

Part 1: Understanding RBAC​

RBAC (Role-Based Access Control) allows you to control who can do what in Kubernetes.

Concepts:​

  • Role: Defines permissions within a namespace.
  • ClusterRole: Defines permissions at the cluster level.
  • RoleBinding: Binds a user/group/ServiceAccount to a Role (within a namespace).
  • ClusterRoleBinding: Binds a user/group/ServiceAccount to a ClusterRole (cluster-wide).

Part 2: Creating a Role​

We will create a Role that allows reading and creating Pods in a namespace.

Step 2.1: Create a Test Namespace​

Create a namespace for testing:

kubectl create namespace rbac-test

Step 2.2: Create a Role​

Create role-pod-manager.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: rbac-test
  name: pod-manager
rules:
- apiGroups: [""] # Core API group (v1)
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["pods/status"]
  verbs: ["get"]

Explanation:

  • apiGroups: [""]: Core API group (resources like Pods, Services, etc.).
  • resources: ["pods"]: Resource to which the permissions apply.
  • verbs: Authorized actions (get, list, watch, create, update, patch, delete).

Apply the Role:

kubectl apply -f role-pod-manager.yaml

Verify:

kubectl get role -n rbac-test
kubectl describe role pod-manager -n rbac-test

Part 3: Creating a RoleBinding​

We will create a RoleBinding that binds a ServiceAccount to the Role.

Step 3.1: Create a ServiceAccount​

Create a ServiceAccount:

kubectl create serviceaccount pod-manager-sa -n rbac-test

Step 3.2: Create the RoleBinding​

Create rolebinding-pod-manager.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-manager-binding
  namespace: rbac-test
subjects:
- kind: ServiceAccount
  name: pod-manager-sa
  namespace: rbac-test
roleRef:
  kind: Role
  name: pod-manager
  apiGroup: rbac.authorization.k8s.io

Explanation:

  • subjects: To whom the permissions are granted (ServiceAccount, User, Group).
  • roleRef: Reference to the Role (or ClusterRole) to use.

Apply the RoleBinding:

kubectl apply -f rolebinding-pod-manager.yaml

Verify:

kubectl get rolebinding -n rbac-test
kubectl describe rolebinding pod-manager-binding -n rbac-test

Part 4: Testing Permissions​

Step 4.1: Get the ServiceAccount Token​

To test the permissions, we need to use the ServiceAccount token:

# Get the Secret name of the ServiceAccount
SECRET_NAME=$(kubectl get serviceaccount pod-manager-sa -n rbac-test -o jsonpath='{.secrets[0].name}')

# Extract the token
TOKEN=$(kubectl get secret $SECRET_NAME -n rbac-test -o jsonpath='{.data.token}' | base64 -d)

# Get the CA certificate
CA_CERT=$(kubectl get secret $SECRET_NAME -n rbac-test -o jsonpath='{.data.ca\.crt}')

Step 4.2: Test with kubectl auth can-i​

Test permissions with your current context (admin):

# Check if you can create Pods
kubectl auth can-i create pods --namespace=rbac-test

# Check if you can delete Pods
kubectl auth can-i delete pods --namespace=rbac-test

# Check if you can list Services (should be no)
kubectl auth can-i list services --namespace=rbac-test

Step 4.3: Test with the ServiceAccount​

Create a Pod that uses the ServiceAccount:

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: rbac-test
spec:
  serviceAccountName: pod-manager-sa
  containers:
  - name: test
    image: bitnami/kubectl:latest
    command: ["sleep", "3600"]

Apply the Pod:

kubectl apply -f test-pod.yaml

Execute commands in the Pod to test permissions:

# Test creating a Pod (should work)
kubectl exec -n rbac-test test-pod -- kubectl create pod test-pod-2 --image=busybox --dry-run=client -o yaml

# Test listing Pods (should work)
kubectl exec -n rbac-test test-pod -- kubectl get pods

# Test listing Services (should fail)
kubectl exec -n rbac-test test-pod -- kubectl get services

Part 5: Creating a ClusterRole​

A ClusterRole applies to the entire cluster.

Step 5.1: Create a ClusterRole​

Create clusterrole-node-viewer.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-viewer
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]

Apply the ClusterRole:

kubectl apply -f clusterrole-node-viewer.yaml

Part 6: Cleanup​

Delete the created resources:

kubectl delete pod test-pod -n rbac-test
kubectl delete rolebinding pod-manager-binding -n rbac-test
kubectl delete role pod-manager -n rbac-test
kubectl delete serviceaccount pod-manager-sa -n rbac-test
kubectl delete clusterrole node-viewer
kubectl delete namespace rbac-test

Lab Summary​

In this lab, you created Roles and RoleBindings to implement RBAC. You learned how to define permissions with Roles, bind users/ServiceAccounts with RoleBindings, and test permissions.

Next Steps​

The next lab will show you how to use Service Accounts and their permissions in Pods.

Lab 9.2: Service Accounts and Permissions

Lab created on: December 2024