K8s RBAC

Kubernetes RBAC literacy — Role, ClusterRole, RoleBinding, least privilege — on kind YOUR cluster or `$CLOUD_LAB` stub only.

15 min+40 XP3 quiz

Module progress1 of 5

Visual · t31_k8s_rbac

K8s RBAC = named permission rows. kind YOUR cluster. Original Cyberlium.

Opening

Over-permissioned service accounts are cloud breaches waiting — name RBAC objects on YOUR kind cluster before touching prod kube APIs.

Kubernetes RBAC literacy names: Role vs ClusterRole scope, RoleBinding/ClusterRoleBinding, ServiceAccount attachment, verb/resource tuple (get/list/create category), and least-privilege review category. Analyst documents RBAC matrix on `$CLOUD_LAB` kind YOUR cluster or instructor manifest stub — maps one lab workload ServiceAccount to minimum verbs — without applying bindings to stranger clusters, without cluster-admin for convenience, without prod kube API changes without RoE. Cyberlium teaches defender permission vocabulary on labeled lab namespace — NOT how to escalate on unauthorized targets. Refused: unauthorized prod RBAC apply, wildcard `*` rules on lab default, stranger tenant kubeconfig. Lab row: RBAC table (subject, role, resources, verbs) for one lab namespace.

1. Named RBAC objects

Role, ClusterRole, RoleBinding, ServiceAccount — four literacy anchors plus verb/resource tuple.

Namespace scope vs cluster scope — document boundary on lab manifest.

Command guide

Try these commands — Named RBAC objects

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

K8s RBAC — https://kubernetes.io/docs/reference/access-authn-authz/rbac/ K8s authorization — https://kubernetes.io/docs/reference/access-authn-authz/authorization/ OWASP K8s Top 10 — https://owasp.org/www-project-kubernetes-top-10/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl

macOS: Built-in

Windows: Built-in (PowerShell: Invoke-WebRequest)

═══ LINUX / macOS ═══

Command — copy this

export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
curl -sS https://kubernetes.io/docs/reference/access-authn-authz/rbac/ | head -10
cat > "$CLOUD_LAB/k8s/rbac-stub.yaml" <<'EOF'
# RBAC stub — YOUR local kind/minikube cluster only
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app-role
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-rolebinding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: app-sa
roleRef:
  kind: Role
  name: app-role
  apiGroup: rbac.authorization.k8s.io
EOF

Command — copy this

grep -E 'Role|ServiceAccount|cluster-admin' "$CLOUD_LAB/k8s/rbac-stub.yaml" || grep Role "$CLOUD_LAB/k8s/rbac-stub.yaml"

Primary tools to practice this lesson: grep, curl. Reference sites: K8s RBAC (https://kubernetes.io/docs/reference/access-authn-authz/rbac/); K8s authorization (https://kubernetes.io/docs/reference/access-authn-authz/authorization/); OWASP K8s Top 10 (https://owasp.org/www-project-kubernetes-top-10/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Least privilege review

Audit for cluster-admin, secrets get/list wildcard, and bind escalation category.

Lab ServiceAccount gets minimum verbs for one workload — document rejected excess.

3. kind YOUR cluster boundary

kind YOUR cluster or `$CLOUD_LAB` stub only — not stranger tenant kube API.

Refused: prod RBAC without RoE, cluster-admin default, kubeconfig sharing.

4. What you ship: K8s RBAC matrix

RBAC table one namespace + least-privilege note + NEVER stranger kube API line.

5. What you record before the next lesson

K8s RBAC matrix path.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong
Apply cluster-admin RoleBinding to employer prod cluster without ticket.
Right
K8s RBAC matrix from kind YOUR cluster lab namespace. Next: Network Policies.

Mission: K8s RBAC matrix

1) Name four RBAC object types. 2) RBAC table for one lab namespace. 3) Least-privilege review note. 4) Write NEVER stranger kube API line.

Stuck? Ask Cyberlium AI Mentor

Ask Mentor: “Role vs ClusterRole — lab default?”

Knowledge Check

APPLY: K8s RBAC literacy uses:

Multiple choice

Knowledge Check

APPLY: True or False: Prod RBAC apply without RoE is lab.

True or False

Knowledge Check

APPLY: Least privilege means:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)

Guest mode — log in to track XP