ReBAC with Kyverno: Automating Multi-Tenant RBAC at Scale
summary
Replaces manual per-namespace RBAC with an automated ReBAC system using Kyverno generate policies so that 6 generate policies create three tiered roles and RoleBindings on namespace creation (operator/contributor/viewer) with empty subjects for self-service. Deployed on Amazon EKS, it cuts onboarding from hours to under 30 seconds, eliminates about 400 manual cluster-admin actions/month, and hits P99 role provisioning ~1.8s. Covers traps: avoid nonResourceURLs, add preconditions to stop generate-on-DELETE, and set background:true for retroactive reconciliation.
AI-written summary · about
chapters (12)
- 0:00ReBAC with Kyverno intro
- 1:23Manual RBAC problems
- 3:09Kyverno policy architecture
- 4:32Kyverno vs alternatives
- 7:24Live RBAC demo
- 10:54Permission drift handling
- 11:15Production traps
- 13:25Scaling policies
- 14:47Observability metrics
- 15:50Onboarding impact
- 17:38Roadmap and repo
- 20:48Q&A
related talks
27mI Can RBAC, and So Can You!
40mEffective RBAC
56mRBAC 101: Basics, Misconceptions, and the Real World
38mMulti-Tenancy Support & Security Modeling with RBAC and Namespaces
31mKubernetes Native Policy Management with Kyverno!
06mLightning Talk: Why Your Cluster-Wide Policies Are a Risk (And What To Do About It)
06mProject Lightning Talk: The Kyverno Five! Policy Types for the Full Resource Lifecycle
47mFine Grained Authorisation with Relationship Based Access Control