Room 27

RBAC ROLES

The Access Control Room

RBAC (Role-Based Access Control) governs who can do what in Kubernetes.
A ServiceAccount needs permission to list pods - create the right Role and RoleBinding.

📜 Mission Briefing

Create a Role that allows get, list, watch on pods in the escape-rbac namespace.
Create a RoleBinding that binds this Role to ServiceAccount pod-reader.
Exec into a pod running as pod-reader and verify it can list pods.
The Role has an annotation with the password: rbacbind.

Key Commands

Command	Purpose
`kubectl create role NAME --verb=V --resource=R`	Create Role
`kubectl create rolebinding NAME --role=R --serviceaccount=NS:SA`	Create binding
`kubectl auth can-i VERB RESOURCE --as=system:serviceaccount:NS:SA`	Check access

How RBAC Works

# Role: Namespace-scoped permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: escape-rbac
  annotations:
    escape-password: "rbacbind"
rules:
  - apiGroups: [""]           # "" = core API group
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
---
# RoleBinding: Binds Role to subjects (Users, Groups, ServiceAccounts)
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: escape-rbac
subjects:
  - kind: ServiceAccount
    name: pod-reader
    namespace: escape-rbac
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# RBAC components:
# Role:              Namespace-scoped permissions
# ClusterRole:       Cluster-wide permissions
# RoleBinding:       Binds Role to subjects in a namespace
# ClusterRoleBinding: Binds ClusterRole to subjects cluster-wide

# Common verbs: get, list, watch, create, update, patch, delete

# Create imperatively
kubectl create role pod-reader --verb=get,list,watch --resource=pods -n escape-rbac
kubectl create rolebinding read-pods --role=pod-reader \
  --serviceaccount=escape-rbac:pod-reader -n escape-rbac

# Test permissions
kubectl auth can-i list pods -n escape-rbac \
  --as=system:serviceaccount:escape-rbac:pod-reader
# yes

kubectl auth can-i delete pods -n escape-rbac \
  --as=system:serviceaccount:escape-rbac:pod-reader
# no

Hints

Hint 1

kubectl create ns escape-rbac
kubectl apply -f role.yaml
kubectl apply -f rolebinding.yaml

Hint 2

Check permissions:

kubectl auth can-i list pods -n escape-rbac \
  --as=system:serviceaccount:escape-rbac:pod-reader

Hint 3

The password is rbacbind.

🔓 Unlock Room 28

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_28/README             \
        -out ../room_28/README.txt        \
        -pass pass:PASSWORD
cat ../room_28/README.txt