1.9 KiB
Exercise — RBAC
We want to:
-
Create two namespaces for users
aliceandbob -
Give each user full access to their own namespace
-
Give each user read-only access to the other's namespace
-
Let
aliceview the nodes of the cluster as well
Initial setup
-
Create two namespaces named
aliceandbob -
Check that if we impersonate Alice, we can't access her namespace yet:
kubectl --as alice get pods --namespace alice
Access for Alice
-
Grant Alice full access to her own namespace
(you can use a pre-existing Cluster Role)
-
Check that Alice can create stuff in her namespace:
kubectl --as alice create deployment hello --image nginx --namespace alice -
But that she can't create stuff in Bob's namespace:
kubectl --as alice create deployment hello --image nginx --namespace bob
Access for Bob
-
Similarly, grant Bob full access to his own namespace
-
Check that Bob can create stuff in his namespace:
kubectl --as bob create deployment hello --image nginx --namespace bob -
But that he can't create stuff in Alice's namespace:
kubectl --as bob create deployment hello --image nginx --namespace alice
Read-only access
-
Now, give Alice read-only access to Bob's namespace
-
Check that Alice can view Bob's stuff:
kubectl --as alice get pods --namespace bob -
But that she can't touch this:
kubectl --as alice delete pods --namespace bob --all -
Likewise, give Bob read-only access to Alice's namespace
Nodes
-
Give Alice read-only access to the cluster nodes
(this will require creating a custom Cluster Role)
-
Check that Alice can view the nodes:
kubectl --as alice get nodes -
But that Bob cannot:
kubectl --as bob get nodes -
And that Alice can't update nodes:
kubectl --as alice label nodes --all hello=world