Hands-On Microservices with Kubernetes

Managing permissions with RBAC

RBAC is a mechanism that's used to manage access to Kubernetes resources. With effect from Kubernetes 1.8, RBAC is considered stable. Start the API server with --authorization-mode=RBAC to enable it. RBAC works as follows when a request to the API server comes in:

1. First, it authenticates the request via the user credentials or service account credentials of the caller (returns 401 unauthorized if it fails).
2. Next, it checks the RBAC policies to verify whether the requester is authorized to perform the operation on the target resource (returns 403 forbidden if it fails).
3. Finally, it runs through an admission controller that may reject or modify the request for various reasons.

The RBAC model consists of identities ...