RBAC - Limit access for one service account

问题

I want to limit the permissions to the following service account, created it as follows:

kubectl create serviceaccount alice --namespace default

secret=$(kubectl get sa alice -o json | jq -r .secrets[].name)

kubectl get secret $secret -o json | jq -r '.data["ca.crt"]' | base64 -d > ca.crt

user_token=$(kubectl get secret $secret -o json | jq -r '.data["token"]' | base64 -d)

c=`kubectl config current-context`

name=`kubectl config get-contexts $c | awk '{print $3}' | tail -n 1`

endpoint=`kubectl config view -o jsonpath="{.clusters[?(@.name == \"$name\")].cluster.server}"`

kubectl config set-cluster cluster-staging \
  --embed-certs=true \
  --server=$endpoint \
  --certificate-authority=./ca.crt

kubectl config set-credentials alice-staging --token=$user_token

kubectl config set-context alice-staging \
  --cluster=cluster-staging \
  --user=alice-staging \
  --namespace=default

kubectl config get-contexts

#kubectl config use-context alice-staging

This has permission to see everything with: kubectl --context=alice-staging get pods --all-namespaces

I try to limit it with the following, but still have all the permissions:

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: no-access
rules:
- apiGroups: [""]
  resources: [""]
  verbs: [""]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: no-access-role
subjects:
- kind: ServiceAccount
  name: alice
  namespace: default
roleRef:
  kind: ClusterRole
  name: no-access
  apiGroup: rbac.authorization.k8s.io

The idea is to limit access to a namespace to distribute tokens for users, but I do not get it ... I think it may be for inherited permissions but I can not disabled for a single serviceacount.

Using: GKE, container-vm

THX!

回答1:

Note that service accounts are not meant for users, but for processes running inside pods (https://kubernetes.io/docs/admin/service-accounts-admin/).

In Create user in Kubernetes for kubectl you can find how to create a user account for your K8s cluster.

Moreover, I advise you to check whether RBAC is actually enabled in your cluster, which could explain that a user can do more operations that expected.

来源：https://stackoverflow.com/questions/44946347/rbac-limit-access-for-one-service-account