Introduction to RBAC

Before we jump into RBAC, let's take a quick look at the history of Kubernetes and access controls.

Before Kubernetes 1.6, access controls were based on Attribute-Based Access Control (ABAC). As the name implies, ABAC provides access by comparing a rule against attributes, rather than roles. The assigned attributes can be assigned any type of data, including user attributes, objects, environments, and locations.

In the past, to configure a Kubernetes cluster for ABAC, you had to set two values on the API server:

• --authorization-policy-file
• --authorization-mode=ABAC

authorization-policy-file is a local file on the API server. Since it's a local file on each API server, any changes to the file require privileged access to the host and will require you to restart the API server. As you can imagine, the process to update ABAC policies becomes difficult and any immediate changes will require a short outage as the API servers...