HackBlue

Labs / Identity and access

Kubernetes RBAC checker

Ask who can do what in a small cluster. The checker follows each RoleBinding and ClusterRoleBinding and names the rule that allows or denies the request.

  • Interactive lab
  • Intermediate
  • 5 steps
  • 0 of 5 solved

Goal

A small cluster runs a shop, a payments service, and monitoring. Pick a subject, a verb, a resource, and a namespace, and the checker answers like kubectl auth can-i, naming every binding that grants the request.

You can switch bindings off to see what a cleanup would change before you make it.

Subject

Access check
$ kubectl auth can-i delete pods -n shop --as maya
no

No binding grants this. RBAC has no deny rules, so anything not granted is refused.

Bindings in the cluster

  • RB
    shop/devs-readRole/pod-reader → Group dev-team
  • RB
    shop/ci-deployRole/deployer → ServiceAccount shop/ci
  • RB
    shop/ci-secretsClusterRole/secret-reader → ServiceAccount shop/ci
  • CRB
    monitoring-viewClusterRole/view-lite → ServiceAccount monitoring/prometheus
  • CRB
    legacy-secretsClusterRole/secret-reader → Group system:serviceaccounts
Roles and ClusterRoles
Role: shop/pod-reader
  - apiGroups: [""]  resources: [pods, pods/log]  verbs: [get, list, watch]

Role: shop/deployer
  - apiGroups: ["apps"]  resources: [deployments]  verbs: [get, list, update, patch]
  - apiGroups: [""]  resources: [configmaps]  verbs: [get, list]

ClusterRole: secret-reader
  - apiGroups: [""]  resources: [secrets]  verbs: [get, list]

ClusterRole: view-lite
  - apiGroups: [""]  resources: [pods, services, configmaps]  verbs: [get, list, watch]

Steps

  1. 01Can maya delete pods in the shop namespace?

  2. 02Can the shop/ci service account update deployments in payments?

  3. 03The shop/default service account can read secrets in kube-system. Which binding grants that?

  4. 04In which namespaces can monitoring/prometheus list pods?

  5. 05Disable legacy-secrets. Where can shop/ci still read secrets?