Kubernetes RBAC Operations: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
Line 29: Line 29:
==With Metadata==
==With Metadata==
==With CLI==
==With CLI==
<syntaxhighlight lang='bash'>
kubectl-admin create rolebinding some-role-binding --role=some-role --serviceaccount=some-namespace:some-sa
</syntaxhighlight>


=Assigning a Cluster Role to a Service Account=
=Assigning a Cluster Role to a Service Account=

Revision as of 02:11, 5 September 2020

Internal

List Cluster Roles

kubectl get clusterroles

Get Details about a Specific Cluster Role

kubectl -o yaml get clusterroles cluster-admin

List Cluster Role Bindings

kubectl get clusterrolebindings

Get Details about a Specific Cluster Role Binding

kubectl get clusterrolebindings cluster-admin -o yaml

Create a Role

With Metadata

With CLI

kubectl-admin create role some-role --verb=use --resource=podsecuritypolicy --resource-name=example

Create a Role Binding

With Metadata

With CLI

kubectl-admin create rolebinding some-role-binding --role=some-role --serviceaccount=some-namespace:some-sa

Assigning a Cluster Role to a Service Account

Using Metadata

kubectl apply -f 

the following manifest:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: blue-default-service-account-cluster-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: default
    namespace: blue

With CLI

kubectl create rolebinding -n <namespace> <role-binding-name> --clusterrole=<clusterrole-name> --serviceaccount=<namespace>:<serviceaccount-name>
kubectl create rolebinding -n blue edit-blue-serviceaccount-binding --clusterrole=edit --serviceaccount=blue:blue-serviceaccount