I Can RBAC, and So Can You!
summary
Explains concrete RBAC limits (you cannot express “everything except X”, no referential integrity) and recommends identity-backed groups and OIDC for auth; demonstrates a working team-based system that auto-creates groups and labels with OpenUnison and uses Fairwinds RBAC Manager to generate bindings so namespace label changes immediately revoke access; points to audit2rbac for policy generation and shows that automation replaces repetitive role bindings and makes multi-tenant namespace management feasible.
AI-written summary · about
chapters (12)
- 0:00Intro
- 1:03What is RBAC and What Can It Do?
- 5:39Authentication Review
- 7:56Multi-Tenancy
- 12:49Anatomy of RBAC Objects
- 15:39Aggregate Roles
- 17:14Automation
- 17:56Custom Controllers
- 18:51Policy Generation
- 19:39Demo!
- 25:36Resources
- 26:00Shameless Self Promotion
related talks
56mRBAC 101: Basics, Misconceptions, and the Real World
40mEffective RBAC
35mRBAC to the Future: Untangling Authorization in Kubernetes
38mMulti-Tenancy Support & Security Modeling with RBAC and Namespaces
24mReBAC with Kyverno: Automating Multi-Tenant RBAC at Scale
33mHow the Basics Of Kubernetes Auth Scale For Organizations
30mKubernetes RBAC at scale without losing your sanity
35mManaging RBAC Cross Multiple Kubernetes Clusters