Playing around with my MicroK8S i was thinking about restricting access to the default namespace. Why?
Every command adds something and so your default namespace gets polluted more and more and cleaning up might be a lot of work.
There is neither a HOWTO nor some quickstart into this. Everything you can find is:
But after this very detailed article you know a lot of things, but for restricting the kubectl you are as smart as before.
One thing i learned in this article:
You do not have to use these YAML files - everything can be done with commands and their options (i do not like YAML, so this was a very important understanding for me).
At the end it is very easy:
and just test it with:export K8S_USER="ateamuser"
kubectl create namespace $NAMESPACE
kubectl label namespaces $NAMESPACE team=a
kubectl create clusterrole ateamrole --verb="*" --resource="*.*"
kubectl create rolebinding $BINDING --clusterrole=$ROLE --user=$K8S_USER -n $NAMESPACE
kubectl create serviceaccount $K8S_USER -n $NAMESPACE
kubectl describe sa $K8S_USER -n $NAMESPACE
So there is not a big script needed - but building these commands was really a hard job...root@zigbee:/home/ubuntu/kubernetes# kubectl get pods -n ateam --as=ateamuser
NAME READY STATUS RESTARTS AGE
web-96d5df5c8-cc9jv 1/1 Running 0 14m
root@zigbee:/home/ubuntu/kubernetes# kubectl get pods -n default --as=ateamuser
Error from server (Forbidden): pods is forbidden: User "ateamuser" cannot list resource "pods" in API group "" in the namespace "default"
If you want to know, how to restrict the kubectl on a remote computer, please write a comment.
One last remark: In microK8s you enable RBAC with the command
Check this with
microk8s is running
datastore master nodes: 192.168.178.57:19001
datastore standby nodes: none
dashboard # The Kubernetes dashboard
dns # CoreDNS
ha-cluster # Configure high availability on the current node
ingress # Ingress controller for external access
metrics-server # K8s Metrics Server for API access to service metrics
rbac # Role-Based Access Control for authorisation
helm # Helm 2 - the package manager for Kubernetes
helm3 # Helm 3 - Kubernetes package manager
host-access # Allow Pods connecting to Host services smoothly
linkerd # Linkerd is a service mesh for Kubernetes and other frameworks
metallb # Loadbalancer for your Kubernetes cluster
registry # Private image registry exposed on localhost:32000
storage # Storage class; allocates storage from host directory