08 · Security

Least privilege that works

Grant what the documented behaviour needs. Check access as the workload, and read every denial.

2-minute guide
All field guides

The model

An access decision has three parts: who (a user or ServiceAccount), what (a verb on a resource) and where (a namespace or the whole cluster). Kubernetes RBAC is additive: a request is allowed only if a bound Role or ClusterRole grants it.

A denial is evidence. 401 means the identity was not recognised; 403 means it was recognised and refused. Close that one gap. Widening a role silences the symptom and hands over everything else. For a sign-in, find which hop refused, browser, identity provider or application, and read its reason.

Illustrative — fictional names; one identity, grants per namespace.

Worked example

A metrics agent runs as ServiceAccount agent in ops. It lists pods in ops but gets 403 Forbidden in shop. Its Role and RoleBinding exist only in ops. The narrow repair is a Role and RoleBinding in shop for the same rule, not a cluster-wide binding to cluster-admin.

Then ask the API as the agent, and confirm the agent itself succeeds. Your own kubectl access says nothing about its access.

Commands worth running

Example names are fictional. Read before you grant.

kubectl auth can-i list pods -n shop \
  --as=system:serviceaccount:ops:agent

Asks the authorizer on the workload’s behalf and prints yes or no. Impersonation needs its own permission.

kubectl get rolebindings -n shop -o wide

Shows which Role each binding grants, and to which subjects. Read the Role’s rules before editing anything.

openssl s_client \
  -connect web.example:443 \
  -servername web.example </dev/null \
  | openssl x509 -noout -subject -enddate

Shows the certificate actually served. After a rotation the end date should move; if not, the server still holds the old one.

Self-check

A new workload gets 403 Forbidden. What do you establish before granting anything?
Show answer
The identity it runs as, the exact verb, resource and namespace refused, and whether its documented behaviour needs that access. Then grant that rule to that identity only.

References

Practise it

The departures boards stopped updating The portal refuses a legitimate sign-in