Securing access to Secrets with RBAC

A cross-cutting concern when it comes to Kubernetes objects is authorized access. Overall, the state of a system is something sensitive. You should have authorized access for operations such as changing the number of replicas for a deployment or changing the autoscaling rules for a deployment. The security mechanism that Kubernetes provides us with is RBAC.

RBAC introduction

RBAC consists of the following Kubernetes objects:

• Roles
• Role bindings
• Cluster roles
• Cluster role bindings

We will check each component separately and see how they are combined with Kubernetes Secrets.

Roles

Roles are a set of permissions that take effect only on the namespace where the role resides. By specifying a role, we define operations that can be executed upon a Kubernetes resource. Roles have the following format:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: secret...