How the Basics Of Kubernetes Auth Scale For Organizations
summary
Explains how Kubernetes RBAC composes into a scalable, least-privilege model: roles, clusterroles, rolebindings and clusterrolebindings mapped to users, groups and service accounts; live demos show listing bootstrap clusterroles and clusterrole aggregation in action so one central clusterrole can collect permissions from extensions. Covers identity choices (kubelogin, Pinniped), service-account scoping across namespaces, resourceNames limits that only work with server-side apply, and running impersonation/access probes in CI to validate who can actually do destructive verbs.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 2:08Why auth matters
- 5:19Auth vs authorization
- 8:47RBAC subjects groups
- 10:15Roles vs cluster roles
- 13:03Role bindings explained
- 17:38Cross namespace access
- 19:25Advanced RBAC features
- 21:36Cluster role aggregation
- 23:26Default RBAC roles
- 26:59RBAC subresources impersonation
- 27:42External identity providers
- 29:06Operationalizing access control
- 30:28Testing access permissions
- 31:31Security limitations
related talks
56mRBAC 101: Basics, Misconceptions, and the Real World
35mRBAC to the Future: Untangling Authorization in Kubernetes
31mKubernetes RBAC Security: A Practical Overview
40mEffective RBAC
33mBeyond Cluster-Admin: Getting Started with Kubernetes Users and Permissions
35mSmarter Kubernetes Access Control: A Simpler Approach to Auth
32mStop giving root access and start securing your Kubernetes clusters instead
41mKubernetes Auth and Access Control