2 lines
4.2 KiB
HTML
2 lines
4.2 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 9: Precise RBAC</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0009 · 35 minutes · Minimize Microservice Vulnerabilities</p><h1>Grant incident access without granting escalation paths</h1><p class="lede">A useful incident identity often needs narrow read access across a namespace. The trap is solving that requirement with a wildcard or by forgetting that logs are a separate subresource.</p><div class="callout"><strong>Exam reflex:</strong> translate every requested action into an API resource, verb, and scope. Treat <code>pods/log</code> as distinct from <code>pods</code>, and use <code>resourceNames</code> when the task names a single object.</div><h2>Timed task: 25 minutes</h2><p>Apply <code>lab/lesson-9-fixture.yaml</code>. Then create <code>lab/lesson-9-answer.yaml</code> from scratch.</p><p>In the <code>incident-response</code> namespace, grant the ServiceAccount <code>audit-bot</code> from namespace <code>security-ops</code> exactly these permissions:</p><ul><li><code>get</code>, <code>list</code>, and <code>watch</code> Pods.</li><li><code>get</code> Pod logs.</li><li><code>get</code> only the ConfigMap named <code>incident-playbook</code>.</li></ul><p>It must not be able to read Secrets, create Pods, execute into Pods, or read any other ConfigMap. Use a namespace-scoped role and binding; do not use a ClusterRole or wildcard resources/verbs.</p><h2>Verification</h2><pre><code>kubectl --context kind-cks-lab apply -f .\lab\lesson-9-fixture.yaml kubectl --context kind-cks-lab apply -f .\lab\lesson-9-answer.yaml $sa = 'system:serviceaccount:security-ops:audit-bot' kubectl --context kind-cks-lab auth can-i get pods --as=$sa -n incident-response kubectl --context kind-cks-lab auth can-i watch pods --as=$sa -n incident-response kubectl --context kind-cks-lab auth can-i get pods/log --as=$sa -n incident-response kubectl --context kind-cks-lab auth can-i get configmap/incident-playbook --as=$sa -n incident-response kubectl --context kind-cks-lab auth can-i get configmap/another-config --as=$sa -n incident-response kubectl --context kind-cks-lab auth can-i get secrets --as=$sa -n incident-response kubectl --context kind-cks-lab auth can-i create pods --as=$sa -n incident-response kubectl --context kind-cks-lab auth can-i create pods/exec --as=$sa -n incident-response</code></pre><p>Expected answers, in order: <code>yes yes yes yes no no no no</code>.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Why does granting <code>get</code> on <code>pods</code> not automatically permit <code>kubectl logs</code>?</p><label><input type="radio" name="q" value="subresource">Logs use the distinct <code>pods/log</code> subresource.</label><label><input type="radio" name="q" value="namespace">Pod logs are always cluster-scoped.</label><label><input type="radio" name="q" value="secret">Logs require Secret access.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">RBAC reference</a>. Confirm the subject format for a cross-namespace ServiceAccount and the behavior of <code>resourceNames</code>.</p><h2>What to send me</h2><p>Paste only your Role and RoleBinding YAML, then the eight <code>can-i</code> results. I’ll review least privilege—not merely whether the allowed commands return yes.</p><footer>Previous: <a href="0008-networkpolicy-default-deny.html">NetworkPolicy default deny</a> · CKS domain: Minimize Microservice Vulnerabilities</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='subresource'){f.textContent='Correct. RBAC authorizes the pods/log subresource independently.';f.className='feedback good';}else{f.textContent='Not quite. Pod logs use their own API subresource, pods/log.';f.className='feedback bad';}}</script></body></html>
|