Kubernetes RBAC Example - Revision history

Busk at 21:03, 5 August 2021

2021-08-05T21:03:17Z

Busk at 20:01, 5 August 2021

2021-08-05T20:01:23Z

Busk at 20:59, 18 July 2021

2021-07-18T20:59:09Z

Busk at 20:55, 18 July 2021

2021-07-18T20:55:28Z

Busk at 19:14, 18 July 2021

2021-07-18T19:14:39Z

Busk at 19:13, 18 July 2021

2021-07-18T19:13:12Z

Busk at 19:09, 18 July 2021

2021-07-18T19:09:12Z

Busk at 18:17, 18 July 2021

2021-07-18T18:17:38Z

Busk: Created page with "- https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html - https://medium.com/@rschoening/read-only-access-to-kubernetes-cluster-fcf84670b698 ``` s=$(kubect..."

2021-07-18T18:14:30Z

Created page with "- https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html - https://medium.com/@rschoening/read-only-access-to-kubernetes-cluster-fcf84670b698 ``` s=$(kubect..."

New page

- https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html
- https://medium.com/@rschoening/read-only-access-to-kubernetes-cluster-fcf84670b698

```
s=$(kubectl describe sa test-sa | grep Tokens | awk '{print $2}'); kubectl get secret $s -o "jsonpath={.data['ca\.crt']}"
s=$(kubectl describe sa test-sa | grep Tokens | awk '{print $2}'); kubectl get secret $s -o "jsonpath={.data['ca\.crt']}"
``

← Older revision		Revision as of 21:03, 5 August 2021
Line 1:		Line 1:
	# RBAC Pod Runner via ServiceAccount		# RBAC Pod Runner via ServiceAccount
		+	- https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengaddingserviceaccttoken.htm

	Why use service account vs user? https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/		Why use service account vs user? https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/

@@ Line 54: / Line 54: @@
    labels:
    name: test-read-only
-   namespace: test
+   # namespace: test this is only in service account
 rules:
 - apiGroups:

← Older revision		Revision as of 20:59, 18 July 2021
Line 4:		Line 4:

	Simple create and delete of namespace and test service account pod that could be used as a runner		Simple create and delete of namespace and test service account pod that could be used as a runner
		+
		+	## wrapper tool
		+	https://gist.github.com/innovia/fbba8259042f71db98ea8d4ad19bd708

	This example is based off of		This example is based off of

← Older revision		Revision as of 20:55, 18 July 2021
Line 1:		Line 1:
	# RBAC Pod Runner via ServiceAccount		# RBAC Pod Runner via ServiceAccount
		+
		+	Why use service account vs user? https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/

	Simple create and delete of namespace and test service account pod that could be used as a runner		Simple create and delete of namespace and test service account pod that could be used as a runner

@@ Line 1: / Line 1: @@
 - https://medium.com/@rschoening/read-only-access-to-kubernetes-cluster-fcf84670b698
 # Use Service Account for Namespaced Admin Runner
@@ Line 128: / Line 130: @@
 kubectl exec test -- cat /run/secrets/kubernetes.io/serviceaccount/ca.crt
 ```

@@ Line 5: / Line 5: @@
 s=$(kubectl describe sa test-sa | grep Tokens | awk '{print $2}'); kubectl get secret $s   -o "jsonpath={.data['ca\.crt']}"
 s=$(kubectl describe sa test-sa | grep Tokens | awk '{print $2}'); kubectl get secret $s   -o "jsonpath={.data['ca\.crt']}"
-``
+```