CKSKubernetes 1.35

Exercises

Exercise: a user who can read logs and nothing else

updated 2026-10-22 by seed

Host: controlplane · Time: 7 min · Domain: Cluster Hardening

Task

  • Create user jane (you will not issue a real certificate; use --as).
  • In namespace prod, jane may get, list, watch Pods and read Pod logs.
  • jane must not be able to do anything else in prod, and nothing anywhere else.

Acceptance criteria

  • kubectl auth can-i list pods -n prod --as jane → yes
  • kubectl auth can-i get pods/log -n prod --as jane → yes
  • kubectl auth can-i delete pods -n prod --as jane → no
  • kubectl auth can-i list pods -n default --as jane → no

Solution

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata: {name: pod-reader, namespace: prod}
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata: {name: jane-pod-reader, namespace: prod}
subjects:
- {kind: User, name: jane, apiGroup: rbac.authorization.k8s.io}
roleRef: {kind: Role, name: pod-reader, apiGroup: rbac.authorization.k8s.io}
kubectl auth can-i --list -n prod --as jane

Four checks, not one: allowed, allowed, denied, denied-elsewhere.