Kubernetes Security - ClusterRoles and ClusterRoleBindings: Practical RBAC Guide with Examples

By -

Hello DevOps, DevSecOps Engineers, SREs, and Kubernetes Administrators!

As Kubernetes environments grow, managing access becomes an important part of cluster administration. Not every engineer needs full cluster-admin access. In many situations, we need to provide users with access to specific cluster-wide resources such as Nodes, PersistentVolumes, StorageClasses, or other non-namespaced resources.

This is where Kubernetes RBAC (Role-Based Access Control) becomes extremely useful.

In this article, we will explore ClusterRoles and ClusterRoleBindings with practical examples. We will create permissions for users, bind those permissions to users, validate access, and clean up the configuration.

The examples are based on the practical Kubernetes administration scenarios I have worked with and used while practicing Kubernetes RBAC concepts.

What We Will Learn

In this article, we will cover:

  1. What is a ClusterRole?
  2. What is a ClusterRoleBinding?
  3. ClusterRole vs Role
  4. ClusterRoleBinding vs RoleBinding
  5. Listing ClusterRoles and ClusterRoleBindings
  6. Creating a ClusterRole using the imperative approach
  7. Binding a ClusterRole to a user
  8. Creating ClusterRole YAML declaratively
  9. Granting access to Nodes
  10. Granting access to PersistentVolumes and StorageClasses
  11. Validating permissions with kubectl auth can-i
  12. Cleaning up RBAC resources
  13. Kubernetes RBAC security best practices

Kubernetes User Access Control with ClusterRoleBindings to ClusterRole

 

Prerequisite: 

Before starting, you should have:

  1. A Kubernetes cluster up and running
  2. kubectl configured
  3. Basic understanding of Kubernetes RBAC
  4. Administrative permissions to create ClusterRoles and ClusterRoleBindings

These system related resources such as pods, nodes, storage etcs will be administrated using ClusterRole and ClusterRoleBindings by assigning to a user.
 

Listing ClusterRoles

To list the ClusterRoles in the Kubernetes cluster
kubectl get clusterrole
# Get the Count 
kubectl get clusterrole --no-headers |wc -l

Listing ClusterRoleBindings

To know about the api-resources that have clusterrole and clusterrolebindings. 
k api-resources |grep cluster
To veiew the clusterrolebindings available in this Kubernetes Cluster 
kubectl get clusterrolebindings 
# Get the Count 
kubectl get clusterrolebindings --no-headers |wc -l

Imperative way

Practical Example 1: Create a ClusterRole for DaemonSets

Let's start with a simple example. Suppose user krish needs permission to list DaemonSets across the cluster.

First, verify that the user currently does not have the required access:

# Initial check 
kubectl get daemonsets --all-namespaces --as krish
After confirming, let's create ClusterRole for 'krish' user. 
kubectl create clusterrole list-ds-role \
--resource=daemonsets \
--verb=list

kubectl describe clusterrole list-ds-role

Now create clusterrolebinding list-ds-rb for user 'krish' to map that clusterrole list-ds which created above.

kubectl create clusterrolebinding \
list-ds-rb \
--clusterrole=list-ds-role \
--user=krish
After ClusterRoleBinding assigned to krish again check access: 
kubectl get ds --as krish

Create ClusterRole, ClusterRoleBinding imperative way

Cleanup for ClusterRoles


Cleanup activity can be in the reverse order. First delete the ClusterRoleBinding then clusterrole 
kubectl delete clusterrolebinding list-ds-rb 

kubectl delete clusterrole list-ds
Cleanup ClusterRole and ClusterRoleBindings


 
ClusterRole are Kubernetes Cluster wide and they are not part of any namespace. To know about user or groups are associated with cluster-admin role, use ClusterRoleBindings and describe it. Where we can see in the subject section that will reveals you about user/groups. 
kubectl describe clusterrolebinding cluster-admin
To inspect the clusterrole 'cluster-admin' privileges describe will show the PolicyRules where what resources can be used? and what you can do? The '*' astriek is to indicate that 'all'. If you want to get all resources access then '*.*' should be given. And same way to indicate all actions such as create, delete, list, watch, get use '*'. A new user mahi joined the Kubernetes Administrtors team. She will be focusing on the nodes in the cluster. Let's create a ClusterRole and ClusterRoleBindings so that she gets access to the nodes .
 
Initially we will check that she is able to access the nodes or not. 
kubectl create clusterrole node-admin 
 --verb=get,list,watch --resource=nodes --dry-run=client -o yaml > node-admin.yaml
kubectl apply -f node-admin.yaml
kubectl describe clusterrole node-admin
Let's bind the node-admin clusterrole to mahi user using clusterrolebinding. 
kubectl create clusterrolebinding mahi-rb --clusterrole=node-admin --user=mahi --dry-run=client -o yaml > mahi-rb.yaml

kubectl create -f node-admin-rb.yaml 
kubectl describe clusterrolebindings node-admin-rb

# Check michelle have the access to nodes 
kubectl --as mahi get nodes
If a user responsibilities are growing as they are into the organization for atime being. Here Maheshwari(mahi) user got more responsibilities for maintaining storge that used for Kubernetes cluster. Create the required ClusterRole and ClusterRoleBindings to allow her access Storage. Requirements: 
ClusterRole: storage-admin
Resource: persistentvolumes
Resource: storageclasses
ClusterRoleBinding: mahi-storage-admin
ClusterRoleBinding Subject: mahi
ClusterRoleBinding Role: storage-admin
Now you know all the steps how to proceed on the clusterrole, clusterrolebindings 
 kubectl create clusterrole storage-admin \
  --verb=* --resource=persistentvolumes --resource=storageclasses \
  --dry-run=client -o yaml > storage-admin.yaml
  
kubectl apply -f storage-admin.yaml
kubectl describe clusterrole storage-admin

kubectl create clusterrolebinding mahi-storage-admin-rb \
 --clusterrole=storage-admin --user=mahi --dry-run=client -o yaml > mahi-storage-admin-rb.yaml  
 
 kubectl create -f mahi-storage-admin-rb.yaml
 kubectl describe clusterrolebinding mahi-storage-admin-rb
 
# Validate that authentication given for mahi user to access storage
kubectl get pv --as mahi
kubectl get sc --as mahi
Here the last execution of fetching the storageclasses using 'mahi' is successful.

Production RBAC Best Practices

As an Automation Architect, I recommend keeping the following principles in mind when designing Kubernetes RBAC.

1. Follow Least Privilege

Grant only the resources and verbs required for the user's responsibility.

2. Avoid cluster-admin for Daily Operations

cluster-admin provides extremely broad privileges. Use dedicated roles wherever possible.

3. Prefer Declarative RBAC

Store RBAC YAML in source control and manage it through your normal review and deployment process.

4. Validate With kubectl auth can-i

Before handing access to a user, test the exact permissions:

kubectl auth can-i <verb> <resource> --as <user>

5. Be Careful With Wildcards

Avoid unnecessarily broad rules such as:

verbs:
  - "*"

or:

resources:
  - "*"

unless the requirement genuinely calls for them.

6. Review ClusterRoleBindings Regularly

Over time, users change teams and responsibilities.

Unused ClusterRoleBindings should be reviewed and removed according to your organization's access-management process.

Reader Challenge

Let's turn this into a real Kubernetes administration exercise.

A new Kubernetes administrator, mahi, has the following responsibilities:

Requirement 1

She should be able to:

get
list
watch

Kubernetes Nodes.

Requirement 2

She should be able to view:

PersistentVolumes
StorageClasses

Requirement 3

She must not be able to:

delete nodes
delete persistentvolumes
create clusterroles

Create the appropriate ClusterRoles and ClusterRoleBindings.

Then validate every permission using:

kubectl auth can-i

Bonus challenge:

Run:

kubectl auth can-i --list --as mahi

Review the resulting permissions and determine whether the user has received any permissions beyond the original requirements.

This is a good exercise to understand how Kubernetes RBAC, ClusterRoles, ClusterRoleBindings, and least-privilege access work together.


Reference:

Comments

Post a Comment

Popular Articles

Ansible URI Module Tutorial: Real-World Application Health Checks, REST API Validation and DevOps Automation

By -
Image
Hello DevSecOps and Automation Engineers! Welcome back to the DevOps Hunter blog. One of the most common requirements in enterprise automation is validating whether an application is actually available after a deployment, patching activity, server reboot, or service restart. Simply starting a service does not guarantee that the application is ready to serve users. This is where the Ansible uri module becomes one of the most powerful tools in a DevOps engineer's toolkit. In this hands-on tutorial, we will explore the Ansible URI module, understand its key parameters, and work through several real-world examples that are commonly used in production automation workflows. Production Health Check workflow using URI module What You'll Learn By the end of this article, you will be able to: Understand the purpose of the Ansible URI module Perform HTTP and HTTPS application health checks Validate application response codes Test REST API endpoints Handle multiple acceptable HTTP status...
Read more

DevOps Weapons

By -
Image
To achieve faster application delivery and stable environments, the right tools must be used in DevOps environments. There is no single tool that fits all your needs such as server provisioning, configuration management, automated builds, code deployments, and monitoring. Many factors determine the use of a particular tool in your infrastructure.   In this article, we will look into core tools which can be used in a typical Devops environment. Version Control Tools: Git - An awesome tool to version your source code and collaborate. Terraform  - A tool used in building, changing, and versioning the infrastructure across platforms. Build Orchestration/Continuous Integration Tools: Jenkins - It is an open-source, lightweight CI tool written in Java, with high extensibility and a fast release cycle. Buildbot  - An open-source framework for automating software build, test and release process. CruiseControl  - A CI server written in  # Ruby ...
Read more

Ansible Jinja Templates Explained with Real world examples

By -
Image
Here I'm starting this post with famous ARISTOTLE quote. "We are what we repeatedly do. Excellence, then is not an act, but a Habit" Welcome back Ansible Automations and who are habituated as Ansible automation specialists this post for them to give boosted walk through, In this post why Jinja templates, When managing hundreds of Linux servers, it becomes difficult to maintain separate configuration files for each environment. Development, Testing, UAT, and Production environments often require different values such as hostnames, IP addresses, ports, memory settings, and application URLs. Instead of creating multiple configuration files manually, Ansible uses Jinja2 Templates to dynamically generate configuration files during deployment. Jinja2 allows variables, loops, conditions, and filters to be embedded within template files so that a single template can be reused across multiple systems.  I would like to share my experiments with Jinja2 templates usage on the Ansibl...
Read more