0

I am trying to implement group based authentication in k8s with RBAC. My requirement is as below:

There is a linux group named "readonly". There are 3 users reader1, reader2 and reader3 in readonly group.

How can I implement the RBAC to give readonly access to all the users who are part of that group and all the future users who will become part of that group ? Readonly access means, access to list, get and watch resources using kubectl.

I came across .subjects[0].kind: Group in clusterrolebinding. But not sure how can that be used or if that can even be used for the above scenario

Thanks.

1
  • can explain a bit more? It's not clear what the Linux group would do in k8s? do you mean creating groups in Linux nodes? or just k8s users and groups you are talking about? or whats the relation between Linux group and k8s RBAC in here? – Saikat Chakrabortty Jan 1 at 15:26
1

This is something I have implemented recently.

NOTE: I'm assuming you are aware ho to add users. or users in group in this case.

here is what I have applied:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly_role
rules: 
- apiGroups:
  - ""
  resourceNames:
  - ""
  resources:
  - "pods"
  - "pods/logs"
  - "deployments"
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - watch
  - get
  - list

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: bind_readonly_dev_role
subjects:
- kind: Group
  name: myorg:readonly 
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: readonly_role
  apiGroup: rbac.authorization.k8s.io

You can use either ClusterRole & ClusterRoleBinding or else just Role & Rolebinding, depending on your requirement. In case you are not looking for cluster scoped access, instead just a namespace, I would strongly suggest going with the Role & Rolebinding kind of object.

What I'm doing/creating in the above?

I'm creating one RBAC Role (readonly_role) scoped to Cluster. and in that I'm specifying I want to let access pods, logs (i.e pods/logs), and deployments. additionally you. can also add things like services or else if you just want to give access to all specify "" instead.

in the 2nd part, I'm creating a ClusterRoleBinding Object named bind_readonly_dev_role which ensures only users in group myorg:readonly are having this role or privileges in the role we just created (readonly_role ).

NOTE: Incase you want to allow proxy access to certain applications, like kubectl proxy. you might have to specify them separately in the ClusterRole rules.

I do like this for one of my svc:

- apiGroups:
  - ""
  resourceNames:
  - dashboard:5000
  resources:
  - services/proxy
  verbs:
  - '*'

at last but not least, you have to test if the user has those privileges correct, you can test like this:

kubectl auth  can-i get pods --as myorg:readonly

in the above replace the pods with the object you want the users of the group to have access to.

Hope this helps!

4
  • Thanks @Saikat. Is group myorg:readonly to be created as Linux group "readonly". And is myorg constant. Sorry I am not much aware of group subject. – Navi Jan 1 at 14:04
  • I guess you are talking about the users who access k8s, correct me if I'm wrong? here I'm not talking about the k8s user group and k8s role. Linux users are different. – Saikat Chakrabortty Jan 1 at 15:12
  • I am talking about linux users and linux group. And k8s role based on linux group. Btw, do u hv any link on how to create k8s user group and add user to group. – Navi Jan 1 at 15:17
  • you can find create user doc here: github.com/kubernetes/dashboard/blob/master/docs/user/… – Saikat Chakrabortty Jan 1 at 15:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.