container.training/slides/exercises/rbac-details.md

Exercise — RBAC

We want to:

• Create two namespaces for users alice and bob

• Give each user full access to their own namespace

• Give each user read-only access to the other's namespace

• Let alice view the nodes of the cluster as well

---

Initial setup

• Create two namespaces named alice and bob

• Check that if we impersonate Alice, we can't access her namespace yet:

  kubectl --as alice get pods --namespace alice
  

---

Access for Alice

• Grant Alice full access to her own namespace

  (you can use a pre-existing Cluster Role)

• Check that Alice can create stuff in her namespace:

  kubectl --as alice create deployment hello --image nginx --namespace alice
  

• But that she can't create stuff in Bob's namespace:

  kubectl --as alice create deployment hello --image nginx --namespace bob
  

---

Access for Bob

• Similarly, grant Bob full access to his own namespace

• Check that Bob can create stuff in his namespace:

  kubectl --as bob create deployment hello --image nginx --namespace bob
  

• But that he can't create stuff in Alice's namespace:

  kubectl --as bob create deployment hello --image nginx --namespace alice
  

---

Read-only access

• Now, give Alice read-only access to Bob's namespace

• Check that Alice can view Bob's stuff:

  kubectl --as alice get pods --namespace bob
  

• But that she can't touch this:

  kubectl --as alice delete pods --namespace bob --all
  

• Likewise, give Bob read-only access to Alice's namespace

---

Nodes

• Give Alice read-only access to the cluster nodes

  (this will require creating a custom Cluster Role)

• Check that Alice can view the nodes:

  kubectl --as alice get nodes
  

• But that Bob cannot:

  kubectl --as bob get nodes
  

• And that Alice can't update nodes:

  kubectl --as alice label nodes --all hello=world