From d217e52ab568c98a002b8a9821deadc0378c9d54 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Fri, 9 Apr 2021 17:34:49 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=90=20Add=20rbac-lookup=20plugin=20inf?= =?UTF-8?q?o=20in=20RBAC=20section?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- slides/k8s/authn-authz.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/slides/k8s/authn-authz.md b/slides/k8s/authn-authz.md index b6ae85ca..a1c79131 100644 --- a/slides/k8s/authn-authz.md +++ b/slides/k8s/authn-authz.md @@ -733,17 +733,19 @@ class: extra-details ## Figuring out who can do what -- For auditing purposes, sometimes we want to know who can perform an action +- For auditing purposes, sometimes we want to know who can perform which actions -- There are a few tools to help us with that +- There are a few tools to help us with that, available as `kubectl` plugins: - - [kubectl-who-can](https://github.com/aquasecurity/kubectl-who-can) by Aqua Security + - `kubectl who-can` / [kubectl-who-can](https://github.com/aquasecurity/kubectl-who-can) by Aqua Security - - [Review Access (aka Rakkess)](https://github.com/corneliusweig/rakkess) + - `kubectl access-matrix` / [Rakkess (Review Access)](https://github.com/corneliusweig/rakkess) by Cornelius Weig -- Both are available as standalone programs, or as plugins for `kubectl` + - `kubectl rbac-lookup` / [RBAC Lookup](https://github.com/FairwindsOps/rbac-lookup) by FairwindsOps - (`kubectl` plugins can be installed and managed with `krew`) +- `kubectl` plugins can be installed and managed with `krew` + +- They can also be installed and executed as standalone programs ???