Mastering Kubernetes API Security and Network Policies

Learn how Kubernetes RBAC secures API access by defining roles and bindings to grant read permissions for pods within a development namespace, enforcing least privilege.

Explore the key components of rbac in kubernetes, including roles and cluster roles, and how role bindings and cluster role bindings grant permissions to users or service accounts across namespaces.

Explore how RBAC governs Kubernetes API access by assigning roles and role bindings to users, groups, and service accounts, while using external identity providers for authentication.

Role binding acts as a bridge between users, groups, or service accounts and the permissions defined in a role, assigning that role to the entity to access Kubernetes resources.

Learn how Kubernetes roles define permissions using verbs such as get, list, create, update, and delete. See how a role binding assigns a role to a user or service account.

Define Kubernetes role permissions by specifying verbs and resources to grant a service account access in a namespace, illustrating read access to pods and restricted cross-namespace actions.

Create a namespace-scoped kubernetes role that grants get, list, and watch on pods in the default namespace, defined with rbac api version and role kind.

Bind a role to a user or service account within a namespace using a role binding. Learn about api version, kind, metadata, subject, and roleRef fields and external authentication.

Secure Kubernetes API access with RBAC policies through a scenario-based lab. Explore namespaces, minikube on AWS, and two users with targeted permissions like list, watch, and full pod control.

Set up a Minikube Kubernetes cluster by provisioning an AWS EC2 Ubuntu instance, installing Docker, Minikube, and kubectl, and connecting via SSH with a private key.

Set up a minikube kubernetes cluster on ubuntu by updating the system, installing docker, kubectl, and minikube, and enabling the ubuntu user to run docker without sudo.

Install minikube and kubectl on a linux vm after setting up ubuntu, docker, and dependencies; download, move, and verify the minikube binary, then install kubectl to interact with the cluster.

Install kubectl, grant executable permissions, and move the binary to /usr/local/bin, then verify the kubectl version. Start the minikube cluster to complete the setup.

Start the Minikube cluster using the Docker driver on AWS Ubuntu, download images, configure certificates and keys, boot the control plane, and verify with minikube status and docker ps.

Create a namespace in minikube and deploy an nginx pod inside it using kubectl. Apply RBAC to restrict access, granting get, list, watch for users and create, delete for DevOps.

Generate a private key using OpenSSL with a chosen output file and key size in bits, then create a CSR for secure user authentication in Kubernetes API security.

Generate a certificate signing request with open ssl req -new, using the mini user private key and saving to mini user CSR, while specifying CN and O for secure authentication.

Generate a client certificate to authenticate with a minikube cluster by signing a CSR with the minikube CA using OpenSSL, producing a signed user certificate valid for 365 days.

Verify Kubernetes user credentials by viewing the config in json with kubectl config view --raw -o json and piping to jq, after installing jq via sudo apt install jq.

Create a role in the target namespace to grant get, list, and watch access to pods, defined in a YAML RBAC file and applied with kubectl.

Verify the created role and inspect its permissions using kubectl get role and kubectl describe role, revealing the pods policy rule with get, list, and watch.

Create a role binding to assign the mini user role to a user in a namespace, then apply the binding with kubectl and verify the binding is created.

Generate a private key and a CSR for a DevOps user using OpenSSL; create a Kubernetes client certificate and perform a role binding to enable authorized cluster access.

Sign the devops.cr CSR with the minikube CA using CA.crt and CA.key to produce devops.crt, a signed user certificate valid for one year.

Configure Kubernetes credentials for the DevOps user with kubectl config set-credentials, specifying the username, client certificate, and client key, then verify updates with kubectl config view --raw -o json.

Create a role binding YAML to grant the DevOps user the permissions defined in the DevOps role, apply it with kubectl, and verify the binding in the test namespace.

Test rbac permissions with kubectl auth can-i to validate pod access for devops and mini users, checking get, list, create, and delete in the target namespace.

Switch Kubernetes contexts in your kubeconfig to view the context, its cluster, user, and namespace, then list and create pods with kubectl while examining minikube and devops certificates and permissions.

Create a new kubernetes context for a user with limited permissions (list, watch, get) named mini user desk context, linking cluster mini cube and namespace my dash namespace.

Switch contexts to test rbac permissions, with a mini user having limited get, list, and watch on pods in a namespace, failing to create pods.

Set up and switch a Kubernetes context for the DevOps user with a minikube cluster and a dedicated namespace, validating get, list, watch, create, and delete permissions.

Test RBAC permissions for pod creation and deletion in the my desk namespace using a DevOps user; verify allowed operations and restricted access in the default namespace.

Modify an existing Kubernetes RBAC role by adding the create permission, switch contexts, and verify the updated role to see the new permission enabling pod creation in the target namespace.

Explore Kubernetes network policies that control pod-to-pod and external traffic, enforced by CNI plugins like Calico or Cilium, to block unauthorized access and reduce lateral movement.

Understand Kubernetes network policy components, including pod selector and ingress and egress rules, and compare CNI plugins such as Calico, Psyllium, VNet, and Flannel for policy enforcement.

Explore concrete use case scenarios for network policies, enabling traffic between specific ports, restricting all others, denying ingress or egress to certain namespaces, and implementing zero trust networking.

Set up an AWS Ubuntu VM and install Docker, configure non-root access, install minikube and kubectl, and start the minikube server to prepare for deploying network policies.

Start Minikube with the Cilium CNI, verify Cilium components, and practice restricting port-to-port communication with network policies between two nginx alpine pods.

deploy two nginx alpine pods, assign labels (pod-a and pod-b) using kubectl label, verify labels with kubectl get pods -o wide --show-labels, and test connectivity between the two pods.

Test pod-to-pod connectivity by using curl from pod a to pod b with a three-second timeout via kubectl exec, then verify bidirectional reachability. Kubernetes allows pod communication by default.

Learn to create a Kubernetes network policy that blocks all pod-to-pod and ingress traffic in the default namespace using networking.k8s.io/v1. Apply and verify it with kubectl.

Verify pod-to-pod connectivity is blocked by applying a network policy, testing from pod a to pod b with kubectl exec and curl, and observe a timeout enforced by Cilium plugin.

Explore Kubernetes network policy by blocking ingress between pods in a default namespace. Add an egress rule, reapply with kubectl apply -f, and block internet access.

Learn to enforce selective pod communication in Kubernetes with a network policy that lets only the frontend pod reach the database pod, safeguarding sensitive data.

Create a network policy with ingress rules that allows only pod a to talk to pod b, blocking others, apply with kubectl, and verify connectivity.

Assess pod-to-pod connectivity in kubernetes by applying a default deny policy and refining it to allow only pod a to reach pod b, tested via kubectl exec and curl.

Create a pod with kubectl run using nginx alpine, verify IPs, and test connectivity with kubectl exec and curl, demonstrating a policy that blocks pods except A from B.