Lesson 0003 · 20 minutes

RBAC: grant the minimum—and prove the boundary

Security work is not “make it work.” It is “make the required action work while every unnecessary action stays blocked.”

Career connection: least-privilege reviews are a routine platform-security responsibility. The fastest path is always: identify subject → scope → resource → verb → verification.

Timed task: 12 minutes

In namespace cks-rbac, grant ServiceAccount report-reader permission to get and list only configmaps. It must not create ConfigMaps or read Secrets. Use a namespace-scoped Role and RoleBinding.

  1. Set up only the challenge objects: kubectl --context kind-cks-lab apply -f .\lab\rbac-starter.yaml.
  2. Create your answer in lab/rbac-answer.yaml. Use the official RBAC reference—documentation use is expected.
  3. Apply it to the isolated lab.
  4. Run the four verification commands below. Do not stop after the first success.

Proof commands

kubectl --context kind-cks-lab auth can-i get configmaps \
  -n cks-rbac --as=system:serviceaccount:cks-rbac:report-reader
kubectl --context kind-cks-lab auth can-i list configmaps \
  -n cks-rbac --as=system:serviceaccount:cks-rbac:report-reader
kubectl --context kind-cks-lab auth can-i create configmaps \
  -n cks-rbac --as=system:serviceaccount:cks-rbac:report-reader
kubectl --context kind-cks-lab auth can-i get secrets \
  -n cks-rbac --as=system:serviceaccount:cks-rbac:report-reader

Expected result sequence: yes, yes, no, no.

Retrieval check

Question

A requirement is confined to one namespace. Which binding usually best supports least privilege?

Debrief

Send me your four results and your YAML. I’ll review scope, subject, resource names, verbs, and whether a narrower permission is possible. That review is the feedback loop that builds confidence.