Kubernetes RBAC at scale without losing your sanity
summary
AOE uses Kubernetes’ built‑in aggregationRule on ClusterRole to deploy many tiny cluster roles labeled for specific CRDs or verbs and have them automatically merged into team roles like developer, so one new CRD gets access granted to 20+ teams by adding one small role. Demo uses K3D, Keycloak OIDC login via a kubectl plugin, and an authentication config that maps the OIDC groups claim mapping into Kubernetes groups. It works live and the key limitation is aggregation only applies to cluster‑scoped ClusterRole, not namespace Roles.
AI-written summary · about
chapters (10)
- 0:00Introduction and background
- 1:32What is RBAC
- 2:35Kubernetes RBAC basics
- 4:04Aggregation rules
- 7:34OpenID Connect integration
- 12:58OIDC login demo setup
- 13:41Live OIDC authentication demo
- 17:20Aggregation rule demo
- 23:00Recap and benefits
- 24:04Q&A session
related talks
33mHow the Basics Of Kubernetes Auth Scale For Organizations
35mManaging RBAC Cross Multiple Kubernetes Clusters
56mRBAC 101: Basics, Misconceptions, and the Real World
31mKubernetes OIDC That Works in Practice: Keycloak + RBAC + Kubelogin Without Day‑2 Pain
41mKubernetes Auth and Access Control
59mKubernetes access control in the enterprise
40mEffective RBAC
16mDistributed application level RBAC with OPA