Role-based Access Control (RBAC) Authorization in Kubernetes
DOI:
https://doi.org/10.13052/jicts2245-800X.1132Keywords:
Kubernetes Role-based Access Control, RBAC, Kubernetes Role, Kubernetes RoleBinding, Kubernetes ClusterRole, Kubernetes ClusterRoleBinding, Kubernetes authorization, Kubernetes API groups, Kubernetes aggregationRule, Kubernetes impersonation.Abstract
In computer systems security, role-based access control (RBAC) or role-based security is an approach to restricting system access to authorized users [1]. This paper will describe how the Kubernetes RBAC authorization sub-system works, how to leverage it to secure access to resources in the cluster, and how to validate the set policies through impersonation to ensure users and service accounts are granted the intended rights.
Downloads
References
Role-based access control (Wiki):
https://en.wikipedia.org/wiki/Role-based_access_control.
Using Admission Controllers (Kubernetes documentation):
https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers.
OpenID Connect Tokens (Kubernetes documentation):
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens.
Webhook Mode (Kubernetes documentation):
https://kubernetes.io/docs/reference/access-authn-authz/webhook/.
Kubernetes Service Accounts
https://kubernetes.io/docs/concepts/security/service-accounts/.
Configure Kubernetes to use OpenID Connect Authentication
User-facing roles (Kubernetes documentation):
https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles.
Best Practice Guide to Implementing the Least privilege (Netwrix):
https://www.netwrix.com/guide_to_implementing_the_least_privilege_principle.
User impersonation (Kubernetes documentation):
https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation.
