Kubernetes RBAC and Security

# Kubernetes RBAC and Security

Introduction

Kubernetes RBAC (Role-Based Access Control) and security provide fine-grained control over who can access cluster resources and what actions they can perform. This tutorial covers RBAC, ServiceAccounts, NetworkPolicies, Pod Security Standards, and security hardening best practices.

Learning Objectives

By the end of this tutorial, you will be able to:

• Implement RBAC with Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings
• Configure ServiceAccounts for pod authentication
• Apply NetworkPolicies for network isolation
• Use Pod Security Standards for workload security
• Implement security best practices
• Audit cluster access

Technical Background

RBAC Model

flowchart TD
    User[User/ServiceAccount] -->|bound to| RoleBinding[RoleBinding]
    RoleBinding -->|references| Role[Role]
    Role -->|grants| Rule[Rule]
    Rule -->|on| Resource[Resource]
    
    subgraph Namespace-scoped
    RoleBinding
    Role
    end
    
    subgraph Cluster-scoped
    ClusterRoleBinding[ClusterRoleBinding]
    ClusterRole[ClusterRole]
    end

RBAC Objects

| Object | Scope | Purpose | |--------|-------|---------| | Role | Namespace | Grant permissions within a namespace | | ClusterRole | Cluster | Grant permissions cluster-wide | | RoleBinding | Namespace | Bind Role to user/group/ServiceAccount | | ClusterRoleBinding | Cluster | Bind ClusterRole to user/group/ServiceAccount |

Pod Security Standards

| Level | Description | Use Case | |-------|-------------|----------| | Privileged | No restrictions | System workloads | | Baseline | Minimally restrictive | General applications | | Restricted | Heavily restricted | Security-sensitive workloads |

Prerequisites

• Running Kubernetes cluster
• kubectl configured with cluster-admin access

Hardware and Software Requirements

| Component | Requirement | |-----------|-------------| | Kubernetes Cluster | v1.25+ | | kubectl | v1.25+ |

Step-by-Step Implementation

Phase 1: Create Roles and RoleBindings

#### Role (Namespace-scoped)

# role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]

#### RoleBinding

# rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: development
subjects:
- kind: User
  name: developer
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Phase 2: Create ClusterRoles and ClusterRoleBindings

#### ClusterRole (Cluster-scoped)

# clusterrole.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-admin-readonly
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "list", "watch"]

#### ClusterRoleBinding

# clusterrolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-only-global
subjects:
- kind: User
  name: auditor
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin-readonly
  apiGroup: rbac.authorization.k8s.io

Phase 3: Create ServiceAccounts

#### Create ServiceAccount

# serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: production

#### Use ServiceAccount in Pod

# pod-with-sa.yaml
apiVersion: v1
kind: Pod
metadata:
  name: app-pod
spec:
  serviceAccountName: app-sa
  containers:
  - name: app
    image: myapp:latest

#### Bind Role to ServiceAccount

# sa-rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-sa-binding
  namespace: production
subjects:
- kind: ServiceAccount
  name: app-sa
  namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Phase 4: Configure NetworkPolicies

#### Default Deny

# default-deny.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

#### Allow Specific Traffic

# allow-frontend.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          app: frontend
    ports:
    - protocol: TCP
      port: 8080

Phase 5: Apply Pod Security Standards

#### Namespace-Level Pod Security

# Apply Pod Security Standard labels to namespace
kubectl label namespace production \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/audit=baseline \
  pod-security.kubernetes.io/warn=baseline

#### Pod Security Context

# pod-security-context.yaml
apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
  - name: app
    image: myapp:latest
    securityContext:
      allowPrivilegeEscalation: false
      runAsNonRoot: true
      capabilities:
        drop:
        - ALL
      readOnlyRootFilesystem: true

Phase 6: RBAC Best Practices

#### Least Privilege Example

# least-privilege-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: deployment-manager
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "update", "patch"]
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]

Expected Output

• RBAC roles and bindings configured
• ServiceAccounts created for pods
• NetworkPolicies applied
• Pod Security Standards enforced
• Security context configured on pods

Verification Procedures

| Check | Command | Expected Result | |-------|---------|-----------------| | RBAC | `kubectl get role,rolebinding -A` | Roles and bindings listed | | ServiceAccount | `kubectl get sa -A` | ServiceAccounts listed | | NetworkPolicy | `kubectl get networkpolicy -A` | Policies listed | | Pod Security | `kubectl get ns -L pod-security.kubernetes.io/enforce` | Labels present |

Troubleshooting Scenarios

| Issue | Diagnosis | Resolution | |-------|-----------|------------| | Access denied | Missing RBAC permission | Create/update Role or ClusterRole | | ServiceAccount not found | Wrong namespace | Verify namespace matches | | NetworkPolicy blocking | Policy too restrictive | Adjust ingress/egress rules | | Pod security violation | Restricted PSA | Update securityContext |

Best Practices

• **Least privilege:** Grant minimum permissions needed
• **Use ServiceAccounts:** Don't use default SA for workloads
• **Default deny:** Apply default-deny NetworkPolicy
• **Pod Security Standards:** Use restricted level for sensitive workloads
• **Audit logging:** Enable and review audit logs
• **Regular review:** Review RBAC permissions quarterly

Security Considerations

• **Etcd encryption:** Encrypt secrets at rest
• **API server:** Restrict access with authentication/authorization
• **Container images:** Scan for vulnerabilities
• **Runtime security:** Use Falco or similar for anomaly detection
• **Secrets:** Use external secret managers (Vault, AWS Secrets Manager)

Conclusion

Kubernetes RBAC and security provide the foundation for secure cluster operations. By implementing RBAC, ServiceAccounts, NetworkPolicies, Pod Security Standards, and security best practices, you can protect your Kubernetes cluster from unauthorized access and malicious activity.

References

• Kubernetes RBAC: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
• Pod Security Standards: https://kubernetes.io/docs/concepts/security/pod-security-standards/
• NetworkPolicies: https://kubernetes.io/docs/concepts/services-networking/network-policies/
• ServiceAccounts: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
• Kubernetes Security: https://kubernetes.io/docs/concepts/security/