Skip to main content

Lab 9.2 - Service Accounts and Permissions

Lab Objectives​

By the end of this lab, you will be able to:

  • Create and use Service Accounts.
  • Assign permissions to Service Accounts.
  • Use Service Accounts in Pods.
  • Understand Service Account tokens and secrets.
  • Test API access from a Pod with a Service Account.

Estimated Duration​

45-60 minutes

Prerequisites​

  • kubectl installed and configured.
  • Local Kubernetes cluster running.
  • Knowledge of Service Accounts (Chapter 9.2).

Part 1: Creating a Service Account​

Step 1.1: Create a Service Account​

Create a test namespace:

kubectl create namespace sa-test

Create a Service Account:

kubectl create serviceaccount app-sa -n sa-test

Verify:

kubectl get serviceaccount app-sa -n sa-test
kubectl describe serviceaccount app-sa -n sa-test

Part 2: Assigning Permissions​

Step 2.1: Create a Role with Permissions​

Create role-app-permissions.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: sa-test
  name: app-role
rules:
- apiGroups: [""]
  resources: ["pods", "configmaps"]
  verbs: ["get", "list", "watch", "create"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]

Apply:

kubectl apply -f role-app-permissions.yaml

Step 2.2: Create a RoleBinding​

Create rolebinding-app.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-binding
  namespace: sa-test
subjects:
- kind: ServiceAccount
  name: app-sa
  namespace: sa-test
roleRef:
  kind: Role
  name: app-role
  apiGroup: rbac.authorization.k8s.io

Apply:

kubectl apply -f rolebinding-app.yaml

Part 3: Using in a Pod​

Step 3.1: Create a Pod with the Service Account​

Create pod-with-sa.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: app-pod
  namespace: sa-test
spec:
  serviceAccountName: app-sa
  containers:
  - name: app
    image: bitnami/kubectl:latest
    command: ["sleep", "3600"]

Apply:

kubectl apply -f pod-with-sa.yaml

Verify that the Pod uses the Service Account:

kubectl describe pod app-pod -n sa-test

Part 4: Testing Permissions​

Step 4.1: Test API Access from the Pod​

Test the permissions from the Pod:

# Test listing Pods (should work)
kubectl exec -n sa-test app-pod -- kubectl get pods

# Test creating a ConfigMap (should work)
kubectl exec -n sa-test app-pod -- kubectl create configmap test-cm --from-literal=key=value --dry-run=client -o yaml

# Test listing Services (should fail - no permission)
kubectl exec -n sa-test app-pod -- kubectl get services

Part 5: Tokens and Secrets​

Step 5.1: Examine the Token​

The Service Account has a token stored in a Secret:

# List the Service Account Secrets
kubectl get secrets -n sa-test

# The token is mounted in the Pod at /var/run/secrets/kubernetes.io/serviceaccount/token
kubectl exec -n sa-test app-pod -- cat /var/run/secrets/kubernetes.io/serviceaccount/token

Part 6: Cleanup​

kubectl delete pod app-pod -n sa-test
kubectl delete rolebinding app-binding -n sa-test
kubectl delete role app-role -n sa-test
kubectl delete serviceaccount app-sa -n sa-test
kubectl delete namespace sa-test

Lab Summary​

In this lab, you created and used Service Accounts with RBAC permissions. You learned how to assign permissions, use Service Accounts in Pods, and test API access.

Next Steps​

The next lab will show you how to apply Pod Security Standards.

Lab 9.3: Pod Security Standards

Lab created on: December 2024