Cloud › Module 7 › Lesson 1
K8s RBAC
Kubernetes RBAC literacy — Role, ClusterRole, RoleBinding, least privilege — on kind YOUR cluster or `$CLOUD_LAB` stub only.
Visual · t31_k8s_rbac
K8s RBAC = named permission rows. kind YOUR cluster. Original Cyberlium.
Opening
Over-permissioned service accounts are cloud breaches waiting — name RBAC objects on YOUR kind cluster before touching prod kube APIs.
Kubernetes RBAC literacy names: Role vs ClusterRole scope, RoleBinding/ClusterRoleBinding, ServiceAccount attachment, verb/resource tuple (get/list/create category), and least-privilege review category. Analyst documents RBAC matrix on `$CLOUD_LAB` kind YOUR cluster or instructor manifest stub — maps one lab workload ServiceAccount to minimum verbs — without applying bindings to stranger clusters, without cluster-admin for convenience, without prod kube API changes without RoE. Cyberlium teaches defender permission vocabulary on labeled lab namespace — NOT how to escalate on unauthorized targets. Refused: unauthorized prod RBAC apply, wildcard `*` rules on lab default, stranger tenant kubeconfig. Lab row: RBAC table (subject, role, resources, verbs) for one lab namespace.
1. Named RBAC objects
Role, ClusterRole, RoleBinding, ServiceAccount — four literacy anchors plus verb/resource tuple.
Namespace scope vs cluster scope — document boundary on lab manifest.
Command guide
Try these commands — Named RBAC objects
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, curl. Reference sites: K8s RBAC (https://kubernetes.io/docs/reference/access-authn-authz/rbac/); K8s authorization (https://kubernetes.io/docs/reference/access-authn-authz/authorization/); OWASP K8s Top 10 (https://owasp.org/www-project-kubernetes-top-10/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Least privilege review
Audit for cluster-admin, secrets get/list wildcard, and bind escalation category.
Lab ServiceAccount gets minimum verbs for one workload — document rejected excess.
3. kind YOUR cluster boundary
kind YOUR cluster or `$CLOUD_LAB` stub only — not stranger tenant kube API.
Refused: prod RBAC without RoE, cluster-admin default, kubeconfig sharing.
4. What you ship: K8s RBAC matrix
RBAC table one namespace + least-privilege note + NEVER stranger kube API line.
5. What you record before the next lesson
K8s RBAC matrix path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Apply cluster-admin RoleBinding to employer prod cluster without ticket.
Right
K8s RBAC matrix from kind YOUR cluster lab namespace. Next: Network Policies.
Mission: K8s RBAC matrix
1) Name four RBAC object types. 2) RBAC table for one lab namespace. 3) Least-privilege review note. 4) Write NEVER stranger kube API line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Role vs ClusterRole — lab default?”
Knowledge Check
APPLY: K8s RBAC literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Prod RBAC apply without RoE is lab.
True or False
Knowledge Check
APPLY: Least privilege means:
Multiple choice