LAB05: Authorization in Kubernetes

Create a user: ram

Create a group: DevOps

Assign ram → group DevOps

Give ram full access to vpsxyz namespace

Create a StorageAdmin role so ram can manage Storage resources

(PVC, PV, StorageClass)

This lab uses client certificates (recommended for kubeadm labs).

LAB OUTLINE

1. Create user certificate → ram

2. Add ram to DevOps group

3. Add ram to kubeconfig

4. Create namespace vpsxyz

5. Create Role + RoleBinding for namespace ownership

6. Create StorageAdmin ClusterRole

7. Bind StorageAdmin to ram

8. Test access as ram

1. Create Private Key for User ram

On control-plane:

openssl genrsa -out ram.key 2048

2. Create CSR (with group DevOps)

The group is defined in the CSR using O=DevOps.

openssl req -new -key ram.key -out ram.csr \
   -subj "/CN=ram/O=DevOps"

• CN = username

• O = group

Kubernetes will treat:

• username → ram

• group → DevOps

---

3. Sign the CSR with the Kubernetes Cluster CA

sudo openssl x509 -req -in ram.csr \
  -CA /etc/kubernetes/pki/ca.crt \
  -CAkey /etc/kubernetes/pki/ca.key \
  -CAcreateserial \
  -out ram.crt -days 365

You now have:

• ram.key

• ram.crt

4. Add ram user to kubeconfig

kubectl config set-credentials ram \
  --client-certificate=ram.crt \
  --client-key=ram.key

5. Create a context for ram

kubectl config set-context ram-context \
  --cluster=kubernetes \
  --user=ram

Switch to ram (later during testing):

kubectl config use-context ram-context

6. Create namespace vpsxyz

kubectl create ns vpsxyz

7. Create Role: Namespace Owner (read/write all inside vpsxyz)

vpsxyz-owner.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: namespace-owner
  namespace: vpsxyz
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

Apply:

kubectl apply -f vpsxyz-owner.yaml

8. Bind ram (or DevOps group) to namespace owner

Option A: Bind the group DevOps (recommended)

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: devops-owner-binding
  namespace: vpsxyz
subjects:
- kind: Group
  name: DevOps    # from O=DevOps certificate
roleRef:
  kind: Role
  name: namespace-owner
  apiGroup: rbac.authorization.k8s.io

Apply:

kubectl apply -f devops-owner-binding.yaml

➡ Any user in group DevOps (like ram) can now fully control vpsxyz namespace.

9. Create StorageAdmin ClusterRole

This role gives the user the ability to manage:

• StorageClasses

• PersistentVolumes

• PersistentVolumeClaims

storage-admin.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: storage-admin
rules:
- apiGroups: [""]
  resources: ["persistentvolumes", "persistentvolumeclaims"]
  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]

- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["create", "get", "list", "watch", "update", "patch", "delete"]

Apply:

kubectl apply -f storage-admin.yaml

---

10. Bind ram (or DevOps group) to StorageAdmin

Recommended: Bind the group:

storage-binding.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: devops-storage-admin
subjects:
- kind: Group
  name: DevOps
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: storage-admin

Apply:

kubectl apply -f storage-binding.yaml

11. Test as ram

Switch to ram:

kubectl config use-context ram-context

Test namespace access:

kubectl get pods -n vpsxyz
kubectl run test --image=nginx -n vpsxyz
kubectl delete pod test -n vpsxyz

Should work.

Test StorageAdmin:

kubectl get sc
kubectl get pv
kubectl get pvc -A

Try creating a PVC:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: test-pvc
  namespace: vpsxyz
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 1Gi
  storageClassName: standard

Apply:

kubectl apply -f pvc.yaml

Should work.