Solution RBAC

1. Inspecting API server authorization modes
2. Counting existing Roles
3. Examining the built-in kube-proxy Role
4. Reviewing RoleBindings for kube-proxy
5. Verifying dev-user permissions
6. Granting Pod permissions to dev-user
7. Fixing Pod permissions in the blue namespace
8. Granting Deployment permissions in the blue namespace

​

1. Inspect API Server Authorization Modes

kubectl -n kube-system get pod kube-apiserver -o yaml

- --authorization-mode=Node,RBAC

ps aux | grep kube-apiserver

... --authorization-mode=Node,RBAC ...

​

2. Count Existing Roles

kubectl get roles -n default

No resources found in default namespace.

kubectl get roles --all-namespaces --no-headers | wc -l

12

​

3. Examine the kube-proxy Role

kubectl describe role kube-proxy -n kube-system

• True: It can get the ConfigMap named kube-proxy.
• False: It cannot delete or update the ConfigMap.
• False: It cannot list or watch ConfigMaps.

​

4. Identify the Subject of the kube-proxy RoleBinding

kubectl get rolebindings -n kube-system

NAME          ROLE
kube-proxy    Role/kube-proxy

kubectl describe rolebinding kube-proxy -n kube-system

​

5. Verify dev-user Permissions

kubectl config view

kubectl get pods --as dev-user

Error from server (Forbidden): pods is forbidden: User "dev-user" cannot list resource "pods" in API group "" in the namespace "default"

​

6. Grant Pod Permissions to dev-user

​

6.1 Create the developer Role

kubectl create role developer \
  --verb=list,create,delete \
  --resource=pods \
  -n default

kubectl describe role developer -n default

​

6.2 Bind dev-user to the Role

kubectl create rolebinding dev-user-binding \
  --role=developer \
  --user=dev-user \
  -n default

kubectl describe rolebinding dev-user-binding -n default

kubectl get pods --as dev-user -n default

​

7. Fix Permissions for a Pod in the blue Namespace

1. Inspect existing Roles and RoleBindings:
   kubectl get roles,rolebindings -n blue
   
2. Describe the developer Role:
   kubectl describe role developer -n blue
   
3. Edit the Role to match the actual Pod name:
   kubectl edit role developer -n blue
   
   Update to:
   rules:
   - apiGroups: ['']
     resources:
     - pods
     resourceNames:
     - dark-blue-app
     verbs:
     - get
     - watch
     - create
     - delete
   
4. Verify access:
   kubectl get pod dark-blue-app -n blue --as dev-user
   

​

8. Grant Deployment Permissions in the blue Namespace

1. Edit the developer Role again:
   kubectl edit role developer -n blue
   
2. Add a rule for deployments in the apps API group:
   rules:
   - apiGroups: ['']
     resources:
     - pods
     resourceNames:
     - dark-blue-app
     verbs:
     - get
     - watch
     - create
     - delete
   - apiGroups: ['apps']
     resources:
     - deployments
     verbs:
     - get
     - watch
     - create
     - delete
   
3. Verify:
   kubectl describe role developer -n blue
   
4. Create a Deployment as dev-user:
   kubectl create deployment nginx \
     --image=nginx \
     -n blue \
     --as dev-user
   

​

Links and References

• Kubernetes RBAC Documentation
• kubectl Cheat Sheet
• Configuring Service Accounts