{"id":1282,"date":"2026-11-12T07:24:31","date_gmt":"2026-11-12T07:24:31","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1282"},"modified":"2026-11-12T07:24:32","modified_gmt":"2026-11-12T07:24:32","slug":"kubernetes-rbac-hands-on-labs-and-command-guide","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/kubernetes-rbac-hands-on-labs-and-command-guide\/","title":{"rendered":"Kubernetes RBAC – Hands-On Labs and Command Guide"},"content":{"rendered":"\n

Companion guide for Kubernetes RBAC: Foundations to Essentials (50 slides)<\/strong>. Updated 12 November 2026. Examples follow Kubernetes v1.37 API documentation.<\/p>\n\n\n\n

\n

Execution status:<\/strong> Commands and YAML have been checked against the official Kubernetes documentation and reviewed for internal consistency. They have not<\/strong> been executed against your specific cluster. Run these labs in a disposable Kubernetes environment, never unreviewed in production.<\/p>\n<\/blockquote>\n\n\n\n

Prerequisites and safety<\/h2>\n\n\n\n
    \n
  • A working Kubernetes cluster (self-managed Kubernetes is fine; no EKS, AKS, or GKE required).<\/li>\n\n\n\n
  • An administrator kubeconfig that can create Namespaces, Roles, RoleBindings, ClusterRoles, ClusterRoleBindings, and CertificateSigningRequests.<\/li>\n\n\n\n
  • kubectl<\/code>,\u00a0openssl<\/code>,\u00a0base64<\/code>, and a POSIX shell such as Bash.<\/li>\n\n\n\n
  • For the human-certificate lab, the Kubernetes control plane must have a working signer for\u00a0kubernetes.io\/kube-apiserver-client<\/code>. Approval does not force a signer to issue a certificate.<\/li>\n\n\n\n
  • kubectl auth can-i --as=...<\/code>\u00a0impersonation requires appropriate administrative impersonation permission.<\/li>\n\n\n\n
  • Do not commit, email, screen-record, or share a private key or bearer token.<\/li>\n\n\n\n
  • Do not send learners a copy of an administrator kubeconfig. Set up separate, restricted learner credentials when needed.<\/li>\n<\/ul>\n\n\n\n

    Verify cluster access<\/h3>\n\n\n\n
    kubectl config current-context\nkubectl cluster-info\nkubectl version --client\nkubectl api-resources --api-group=rbac.authorization.k8s.io\nkubectl api-resources --namespaced=false\n<\/code><\/pre>\n\n\n\n
    Lab 0 – Create a safe namespace<\/h2>\n\n\n\n
    kubectl create namespace rbac-lab\nkubectl -n rbac-lab get pods\n<\/code><\/pre>\n\n\n\n
    Lab 1 – Human user access with Role and RoleBinding<\/h2>\n\n\n\n
    Goal:<\/strong> The named user mia<\/code> may read Pods in rbac-lab<\/code>, but may not read Secrets or read Pods in default<\/code>.<\/p>\n\n\n\n
    This lab uses a User identity string<\/strong> with administrator impersonation. Kubernetes has no User<\/code> API object, so there is no kubectl create user<\/code> step.<\/p>\n\n\n\n
    Create a Role<\/h3>\n\n\n\n
    kubectl -n rbac-lab create role pod-reader \\\n  --verb=get,list,watch \\\n  --resource=pods\nkubectl -n rbac-lab describe role pod-reader\n<\/code><\/pre>\n\n\n\n
    Bind the user<\/h3>\n\n\n\n
    kubectl -n rbac-lab create rolebinding mia-read \\\n  --role=pod-reader \\\n  --user=mia\nkubectl -n rbac-lab describe rolebinding mia-read\n<\/code><\/pre>\n\n\n\n
    Verify three behaviors<\/h3>\n\n\n\n
    # Expected: yes<\/em>\nkubectl auth can-i list pods -n rbac-lab --as=mia\n\n# Expected: no<\/em>\nkubectl auth can-i get secrets -n rbac-lab --as=mia\n\n# Expected: no<\/em>\nkubectl auth can-i list pods -n default --as=mia\n<\/code><\/pre>\n\n\n\n
    The expected results assume a clean training cluster without extra grants for the test identity, and an administrator authorized to impersonate users.<\/p>\n\n\n\n
    Equivalent declarative manifest<\/h3>\n\n\n\n
    Save as rbac-mia.yaml<\/code>:<\/p>\n\n\n\n
    apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  name: pod-reader\n  namespace: rbac-lab\nrules:\n  - apiGroups: [\"\"]\n    resources: [\"pods\"]\n    verbs: [\"get\", \"list\", \"watch\"]\n---\napiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  name: mia-read\n  namespace: rbac-lab\nsubjects:\n  - kind: User\n    name: mia\n    apiGroup: rbac.authorization.k8s.io\nroleRef:\n  kind: Role\n  name: pod-reader\n  apiGroup: rbac.authorization.k8s.io\n<\/code><\/pre>\n\n\n\n
    kubectl diff -f rbac-mia.yaml\nkubectl apply -f rbac-mia.yaml\n<\/code><\/pre>\n\n\n\n
    Lab 2 – Real human certificate and group-based access<\/h2>\n\n\n\n
    Goal:<\/strong> Issue a short-duration client certificate for username alice<\/code>, with group team-dev<\/code>; before binding the group, Pod access fails; after binding, Pod access succeeds.<\/p>\n\n\n\n
    Important distinction:<\/strong> alice.csr<\/code> is a PKCS#10 file created by OpenSSL. A Kubernetes CertificateSigningRequest<\/code> is an API object containing the base64-encoded request.<\/p>\n\n\n\n
    1. Generate the private key and certificate request<\/h3>\n\n\n\n
    Run on a trusted workstation. Use a private lab directory.<\/p>\n\n\n\n
    umask 077\nopenssl genrsa -out alice.key 3072\nopenssl req -new -key alice.key -out alice.csr \\\n  -subj \"\/CN=alice\/O=team-dev\"\nopenssl req -in alice.csr -noout -subject\n<\/code><\/pre>\n\n\n\n
    Expected identity: CN=alice<\/code> maps to username alice<\/code> and O=team-dev<\/code> maps to group team-dev<\/code> when using this Kubernetes X.509 authentication mechanism.<\/p>\n\n\n\n
    2. Create the Kubernetes CSR object<\/h3>\n\n\n\n
    Run with credentials allowed to create CertificateSigningRequests.<\/p>\n\n\n\n
    CSR_B64=$(base64 < alice.csr | tr -d '\\n')\ncat <<EOF | kubectl apply -f -\napiVersion: certificates.k8s.io\/v1\nkind: CertificateSigningRequest\nmetadata:\n  name: alice-rbac-lab\nspec:\n  request: ${CSR_B64}\n  signerName: kubernetes.io\/kube-apiserver-client\n  expirationSeconds: 86400\n  usages: [\"client auth\"]\nEOF\n<\/code><\/pre>\n\n\n\n
    This requests one day of validity. The final duration is determined by the issuer’s configuration.<\/p>\n\n\n\n
    3. Review, approve, and wait for actual issuance<\/h3>\n\n\n\n
    An administrator must verify the requested subject and signer before approval.<\/p>\n\n\n\n
    kubectl get csr alice-rbac-lab\nkubectl get csr alice-rbac-lab -o yaml\nkubectl certificate approve alice-rbac-lab\nkubectl get csr alice-rbac-lab -o yaml\n<\/code><\/pre>\n\n\n\n
    Do not<\/strong> proceed just because it is Approved<\/code>. Check .status.certificate<\/code> is populated. The cluster signer might not be configured. A signer must issue the certificate after approval.<\/p>\n\n\n\n
    kubectl get csr alice-rbac-lab \\\n  -o jsonpath='{.status.certificate}' | base64 -d > alice.crt\nopenssl x509 -in alice.crt -noout -subject -dates\n<\/code><\/pre>\n\n\n\n
    On systems where base64 -d<\/code> is unavailable, use the equivalent decode option (some BSD tools support -D<\/code>).<\/p>\n\n\n\n
    Approving CertificateSigningRequests requires specific permissions beyond simple CSR listing: update<\/code> on certificatesigningrequests\/approval<\/code>, and approve<\/code> on the requested signers<\/code> signer; grant these only to approved certificate authorities\/administrators. Refer to the official CSR authorization documentation.<\/p>\n\n\n\n
    4. Add a user context, without switching the active context<\/h3>\n\n\n\n
    These commands add an alice<\/code> user context to the current workstation’s kubeconfig<\/strong>, using its existing trusted cluster entry. Never distribute that kubeconfig if it also contains administrator credentials.<\/strong><\/p>\n\n\n\n
    CLUSTER=$(kubectl config view --minify \\\n  -o jsonpath='{.contexts[0].context.cluster}')\n\nkubectl config set-credentials alice \\\n  --client-certificate=alice.crt \\\n  --client-key=alice.key \\\n  --embed-certs=true\n\nkubectl config set-context alice-rbac-lab \\\n  --cluster=\"$CLUSTER\" \\\n  --user=alice \\\n  --namespace=rbac-lab\n\nkubectl --context=alice-rbac-lab auth whoami\nkubectl --context=alice-rbac-lab -n rbac-lab get pods\n<\/code><\/pre>\n\n\n\n
    Initially, the last command should produce a Forbidden<\/code> result because group team-dev<\/code> is not bound yet. If the identity is not recognized, verify the certificate’s issuer, validity, and subject before changing RBAC.<\/p>\n\n\n\n
    5. Bind the group and verify the permission<\/h3>\n\n\n\n
    kubectl -n rbac-lab create rolebinding team-dev-read \\\n  --role=pod-reader \\\n  --group=team-dev\n\n# Expected: success (a zero-row result is still success)<\/em>\nkubectl --context=alice-rbac-lab -n rbac-lab get pods\n\n# Expected: Forbidden<\/em>\nkubectl --context=alice-rbac-lab -n rbac-lab get secrets\n<\/code><\/pre>\n\n\n\n
    Lab 3 – ServiceAccount identity for an application<\/h2>\n\n\n\n
    Goal:<\/strong> An application ServiceAccount may read ConfigMaps in rbac-lab<\/code> but not Secrets.<\/p>\n\n\n\n
    1. Create a ServiceAccount and one ConfigMap<\/h3>\n\n\n\n
    kubectl -n rbac-lab create serviceaccount audit-bot\nkubectl -n rbac-lab create configmap demo-config \\\n  --from-literal=mode=training\nkubectl -n rbac-lab get serviceaccounts\n<\/code><\/pre>\n\n\n\n
    The authenticated Kubernetes username for this account is system:serviceaccount:rbac-lab:audit-bot<\/code>.<\/p>\n\n\n\n
    2. Define permissions and bind them<\/h3>\n\n\n\n
    kubectl -n rbac-lab create role configmap-reader \\\n  --verb=get,list \\\n  --resource=configmaps\nkubectl -n rbac-lab create rolebinding audit-config-read \\\n  --role=configmap-reader \\\n  --serviceaccount=rbac-lab:audit-bot\n<\/code><\/pre>\n\n\n\n
    3. Create a Pod using that ServiceAccount<\/h3>\n\n\n\n
    Save as sa-demo-pod.yaml<\/code>:<\/p>\n\n\n\n
    apiVersion: v1\nkind: Pod\nmetadata:\n  name: sa-demo\n  namespace: rbac-lab\nspec:\n  serviceAccountName: audit-bot\n  containers:\n    - name: app\n      image: busybox:1.36\n      command: [\"sleep\", \"3600\"]\n<\/code><\/pre>\n\n\n\n
    kubectl apply -f sa-demo-pod.yaml\nkubectl -n rbac-lab get pod sa-demo\nkubectl -n rbac-lab get pod sa-demo -o jsonpath='{.spec.serviceAccountName}'\n<\/code><\/pre>\n\n\n\n
    The Pod image is public but requires outbound registry access to pull. RBAC verification below does not depend on installing kubectl<\/code> inside the Pod.<\/p>\n\n\n\n
    4. Verify with admin impersonation<\/h3>\n\n\n\n
    # Expected: yes<\/em>\nkubectl auth can-i list configmaps -n rbac-lab \\\n  --as=system:serviceaccount:rbac-lab:audit-bot\n\n# Expected: no<\/em>\nkubectl auth can-i get secrets -n rbac-lab \\\n  --as=system:serviceaccount:rbac-lab:audit-bot\n<\/code><\/pre>\n\n\n\n
    5. Tokens and Pod hardening<\/h3>\n\n\n\n
    # Prints a sensitive short-lived token: never use on a public projector<\/em>\nkubectl -n rbac-lab create token audit-bot --duration=10m\n<\/code><\/pre>\n\n\n\n
    Modern Kubernetes Pods generally use projected, bounded ServiceAccount tokens. If a Pod does not need Kubernetes API access, opt out of automatic token mounting:<\/p>\n\n\n\n
    spec:\n  automountServiceAccountToken: false\n<\/code><\/pre>\n\n\n\n
    Lab 4 – ClusterRole, ClusterRoleBinding, and namespaced reuse<\/h2>\n\n\n\n
    1. Cluster-wide read of Nodes<\/h3>\n\n\n\n
    kubectl create clusterrole lab-node-reader \\\n  --verb=get,list,watch \\\n  --resource=nodes\n\nkubectl create clusterrolebinding lab-ops-node-read \\\n  --clusterrole=lab-node-reader \\\n  --group=ops-readers\n\n# Expected: yes, on a clean cluster with admin impersonation permission<\/em>\nkubectl auth can-i list nodes \\\n  --as=pat --as-group=ops-readers\n<\/code><\/pre>\n\n\n\n
    2. Reuse a ClusterRole within just one namespace<\/h3>\n\n\n\n
    kubectl -n rbac-lab create rolebinding qa-view \\\n  --clusterrole=view --group=qa-team\n\n# Expected: yes<\/em>\nkubectl auth can-i list pods -n rbac-lab \\\n  --as=lea --as-group=qa-team\n\n# Expected: no<\/em>\nkubectl auth can-i list pods -n default \\\n  --as=lea --as-group=qa-team\n<\/code><\/pre>\n\n\n\n
    A RoleBinding<\/code> can reference a ClusterRole<\/code>, but access is still restricted to that namespace. A ClusterRoleBinding<\/code> may refer only<\/strong> to a ClusterRole<\/code>.<\/p>\n\n\n\n
    Reference: common RBAC rules<\/h2>\n\n\n\n
    A. Read Pod logs (different from permission to read Pods)<\/h3>\n\n\n\n
    rules:\n  - apiGroups: [\"\"]\n    resources: [\"pods\/log\"]\n    verbs: [\"get\"]\n<\/code><\/pre>\n\n\n\n
    B. Get only a particular ConfigMap<\/h3>\n\n\n\n
    rules:\n  - apiGroups: [\"\"]\n    resources: [\"configmaps\"]\n    resourceNames: [\"demo-config\"]\n    verbs: [\"get\"]\n<\/code><\/pre>\n\n\n\n
    resourceNames<\/code> does not constrain top-level create<\/code> or deletecollection<\/code>; list<\/code> and watch<\/code> restricted by resourceNames<\/code> require a matching metadata.name<\/code> field selector.<\/p>\n\n\n\n
    C. Read a custom resource (example; requires a matching CRD)<\/h3>\n\n\n\n
    rules:\n  - apiGroups: [\"example.com\"]\n    resources: [\"widgets\"]\n    verbs: [\"get\", \"list\"]\n<\/code><\/pre>\n\n\n\n
    D. Read a non-resource API path (ClusterRole only)<\/h3>\n\n\n\n
    rules:\n  - nonResourceURLs: [\"\/healthz\"]\n    verbs: [\"get\"]\n<\/code><\/pre>\n\n\n\n
    Command summary<\/h2>\n\n\n\n
    Purpose<\/th>Command<\/th><\/tr><\/thead>
    Show active identity<\/td>kubectl auth whoami<\/code><\/td><\/tr>
    List API resources<\/td>kubectl api-resources -o wide<\/code><\/td><\/tr>
    List namespace Roles \/ bindings<\/td>kubectl get roles,rolebindings -n rbac-lab<\/code><\/td><\/tr>
    List cluster-scoped roles \/ bindings<\/td>kubectl get clusterroles,clusterrolebindings<\/code><\/td><\/tr>
    Describe a Role<\/td>kubectl describe role pod-reader -n rbac-lab<\/code><\/td><\/tr>
    Test read permission<\/td>kubectl auth can-i list pods -n rbac-lab<\/code><\/td><\/tr>
    Test as another user<\/td>kubectl auth can-i list pods -n rbac-lab --as=mia<\/code><\/td><\/tr>
    See the CSR request<\/td>kubectl get csr alice-rbac-lab -o yaml<\/code><\/td><\/tr>
    Approve a reviewed CSR<\/td>kubectl certificate approve alice-rbac-lab<\/code><\/td><\/tr>
    Request a short-lived SA token<\/td>kubectl -n rbac-lab create token audit-bot --duration=10m<\/code><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
    Troubleshooting<\/h2>\n\n\n\n