Kubernetes ServiceAccount RBAC Restriction Tutorial

This tutorial demonstrates how to restrict a ServiceAccount within a Kubernetes namespace using Namespace-Scoped Role-Based Access Control (RBAC) without disrupting existing workloads. We’ll achieve this through carefully crafted YAML manifests and verification commands.

Scenario

You have a Pod running within a namespace called ‘my-namespace’ that needs to access a Deployment also within ‘my-namespace’. Initially, the Pod has unrestricted access to all resources in the namespace. We’ll create a new ServiceAccount, ‘restricted-sa’, and define a Role with limited permissions for that ServiceAccount, specifically within ‘my-namespace’. We’ll then apply this Role to ‘restricted-sa’, and observe the impact on the Pod’s ability to interact with the Deployment.

Example 1: Initial Unrestricted Access

First, let’s establish the baseline where the Pod has unrestricted access. This demonstrates the scenario we are correcting.

kubectl create namespace my-namespace
kubectl apply -f deployment.yaml
kubectl apply -f pod.yaml
kubectl apply -f serviceaccount.yaml
kubectl apply -f role.yaml
kubectl apply -f rolebinding.yaml

This creates a deployment, a pod, a service account, a role, a rolebinding, and a minimal namespace. The pod is immediately able to list all pods. This is the state we are working to change.

Example 2: Restricting Access – Initial Manifest

Now, let’s create a manifest to restrict the ServiceAccount’s access. This is where the core RBAC configuration resides.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-restricted-role
  namespace: my-namespace
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

This Role defines rules allowing only `get`, `list`, and `watch` operations on `pods` resources within the `my-namespace` namespace. We’ll apply this.

kubectl apply -f restricted-role.yaml

Example 3: Verification and Issue Resolution

After applying the `restricted-role.yaml`, verify the change and observe any errors.

kubectl describe pod my-pod

Potential Issue: You might see an error like “Error from server: error072: get pods /my-namespace: unauthorized”. This indicates the Pod is attempting to access a resource it’s no longer authorized to. This is the expected behavior.

Resolution: The ‘my-pod’ is now restricted from accessing the pods resource. We have successfully limited the ServiceAccount’s permissions.

Example 4: Correcting the RoleBinding (Namespace Scoping)

The previous example only created the Role. We now need to associate this Role with the ServiceAccount. Crucially, we must scope the RoleBinding to the namespace.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-restricted-role-binding
  namespace: my-namespace
subjects:
- kind: ServiceAccount
  name: restricted-sa
  namespace: my-namespace
roleRef:
  kind: Role
  name: my-restricted-role
  namespace: my-namespace

This RoleBinding links the ‘restricted-sa’ ServiceAccount to the ‘my-restricted-role’ Role, within the ‘my-namespace’ namespace. This is critical for namespace-scoped RBAC.

kubectl apply -f restricted-rolebinding.yaml

Example 5: Verification – Successful Restriction

Verify that the ServiceAccount is now restricted.

kubectl describe pod my-pod

Expected Outcome: The output should show that the ‘my-pod’ still exists and is running, but attempting to list pods will result in an “Error from server: error072: get pods /my-namespace: unauthorized” error. The restriction is now enforced.

Conclusion

By carefully defining Roles and RoleBindings, specifically scoping them to namespaces, you can effectively restrict ServiceAccount access within Kubernetes without disrupting existing workloads. This example demonstrates a fundamental RBAC principle for securing your cluster.