Kubernetes RBAC - Revision history

Busk at 06:54, 22 November 2022

2022-11-22T06:54:34Z

Busk at 23:31, 22 August 2021

2021-08-22T23:31:53Z

Busk at 23:31, 22 August 2021

2021-08-22T23:31:26Z

Busk at 23:28, 22 August 2021

2021-08-22T23:28:49Z

Busk at 23:28, 22 August 2021

2021-08-22T23:28:30Z

Busk at 22:09, 22 August 2021

2021-08-22T22:09:32Z

Busk at 21:39, 22 August 2021

2021-08-22T21:39:41Z

Busk at 21:38, 22 August 2021

2021-08-22T21:38:40Z

Busk at 21:35, 22 August 2021

2021-08-22T21:35:46Z

Busk at 21:21, 22 August 2021

2021-08-22T21:21:10Z

← Older revision		Revision as of 06:54, 22 November 2022
Line 1:		Line 1:
		+	https://releasehub.com/blog/how-to-create-and-configure-your-kubernetes-service-account
		+
	# Assigning namespaces permissions to default service account in namepsace test.		# Assigning namespaces permissions to default service account in namepsace test.

@@ Line 57: / Line 57: @@
 </br>
 </br>
@@ Line 72: / Line 67: @@
 </br>
 </br>
+NOTES
 https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html

@@ Line 62: / Line 62: @@
 ############## NOTES ##################
+</br>
+</br>
+</br>
+</br>
+</br>
+</br>
+</br>
+</br>
+</br>
+</br>

← Older revision		Revision as of 23:28, 22 August 2021
Line 62:		Line 62:

	############## NOTES ##################		############## NOTES ##################
		+
		+
		+
		+
		+
		+
		+
		+
		+
		+
		+
		+
		+

@@ Line 1: / Line 1: @@
 https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html
@@ Line 86: / Line 153: @@
 curl -k  https://35.226.193.217/api/v1/namespaces -H "Authorization: Bearer <token>"
 ```
 # Way Number

@@ Line 1: / Line 1: @@
 https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html
-# Way Number 1
+# One way
 ```
 ️⃣ Create Namespace

← Older revision		Revision as of 21:38, 22 August 2021
Line 1:		Line 1:
		+	https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html
		+
	https://stackoverflow.com/questions/66296470/accessing-k8s-cluster-with-service-account-token		https://stackoverflow.com/questions/66296470/accessing-k8s-cluster-with-service-account-token
	```		```

← Older revision		Revision as of 21:35, 22 August 2021
Line 1:		Line 1:
		+	https://stackoverflow.com/questions/66296470/accessing-k8s-cluster-with-service-account-token
		+	```
		+	1
		+
		+	Yes, it is possible. For instance, if you login K8S dashboard via token it does use the same way.
		+
		+	Follow these steps;
		+
		+	Create a service account
		+
		+	$ kubectl -n <your-namespace-optional> create serviceaccount <service-account-name>
		+	A role binding grants the permissions defined in a role to a user or set of users. You can use a predefined role or you can create your own. Check this link for more info. https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-example
		+
		+	$ kubectl create clusterrolebinding <binding-name> --clusterrole=cluster-admin --serviceaccount=<namespace>:<service-account-name>
		+	Get the token name
		+
		+	$ TOKENNAME=`kubectl -n <namespace> get serviceaccount/<service-account-name> -o jsonpath='{.secrets[0].name}'`
		+	Finally, get the token and set the credentials
		+
		+	$ kubectl -n <namespace> get secret $TOKENNAME -o jsonpath='{.data.token}'\| base64 --decode
		+	$ kubectl config set-credentials <service-account-name> --token=<output from previous command>
		+	$ kubectl config set-context --current --user=<service-account-name>
		+	If you follow these steps carefully your problem will be solved.
		+	```
		+
		+
		+

	https://discuss.kubernetes.io/t/how-to-create-user-in-kubernetes-cluster-and-give-it-access/9101		https://discuss.kubernetes.io/t/how-to-create-user-in-kubernetes-cluster-and-give-it-access/9101

← Older revision		Revision as of 21:21, 22 August 2021
Line 11:		Line 11:

	https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#:~:text=Set%20the%20security%20context%20for%20a%20Pod&text=In%20the%20configuration%20file%2C%20the,run%20with%20user%20ID%201000.&text=Any%20files%20created%20will%20also,3000%20when%20runAsGroup%20is%20specified.		https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#:~:text=Set%20the%20security%20context%20for%20a%20Pod&text=In%20the%20configuration%20file%2C%20the,run%20with%20user%20ID%201000.&text=Any%20files%20created%20will%20also,3000%20when%20runAsGroup%20is%20specified.
		+
		+
		+	```
		+	After going through all the above mentioned block, I found below solution
		+
		+	Create user CSR
		+	openssl genrsa -out user1.key 2048
		+	openssl req -new -key user1.key -out user1.csr
		+
		+	Approve CSR
		+	openssl x509 -req -in user1.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out user1.crt -days 500
		+
		+	Create Role or ClusterRole
		+	cat role.yml
		+	kind: Role
		+	apiVersion: rbac.authorization.k8s.io/v1beta1 4
		+	metadata:
		+	namespace: test-namespace
		+	name: user1-role
		+	rules:
		+	- apiGroups: ["", “extensions”, “apps”]
		+	resources: [“deployments”, “pods”, “services”]
		+	verbs: [“get”, “list”, “watch”, “create”, “update”, “patch”, “delete”]
		+
		+	Create RoleBindings
		+	cat binding.yml
		+	kind: RoleBinding
		+	apiVersion: rbac.authorization.k8s.io/v1beta1 4
		+	metadata:
		+	name: user1-rolebinding
		+	namespace: test-namespace
		+	subjects:
		+
		+	kind: User
		+	name: user1
		+	apiGroup: “”
		+	roleRef:
		+	kind: Role
		+	name: user1-role
		+	apiGroup: “”
		+	Use it
		+	kubectl config set-credentials user1 --client-certificate=/root/user1.crt --client-key=user1.key
		+
		+	kubectl config set-context user1-context --cluster=kubernetes --namespace=test-namespace --user=user1
		+	```