gke setting up kubernetes rbac for a user

To configure RBAC capabilities for a gke cluster, we need to enable this feature. This allow the user or principal to grant permission what he/she can do or cannot do in a cluster. 



gcloud projects add-iam-policy-binding project-id \
  --member="user:kepung@gmail.com" \
  --role="roles/viewer"


And you can see this in the IAM portal :-




Next, let's connect to our cluster and create our namespace. The we will create role and rolebinding using the following script:

Creating namespace

kubectl create namespace team-a

Creating role.yaml 

# role-team-a-dev.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: team-a-developer
  namespace: team-a
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch", "create", "update", "delete"]
  - apiGroups: [""]
    resources: ["services"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.istio.io"]
    resources: ["virtualservices", "destinationrules"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

Creating rolebinding 

# rolebinding-team-a-dev.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: team-a-developer-binding
  namespace: team-a
subjects:
  - kind: User
    name: alice@example.com
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: team-a-developer
  apiGroup: rbac.authorization.k8s.io


Apply this 2 files:- 

kubectl apply -f role-team-a-dev.yaml

kubectl apply -f rolebinding-team-a-dev.yaml


# Should be allowed 

kubectl auth can-i create pods -n team-a --as=alice@example.com 

kubectl auth can-i create virtualservices.networking.istio.io -n team-a --as=alice@example.com (only if you have enabled service mesh in your gke cluster)


# Should be denied (different namespace, or no binding) 

kubectl auth can-i create pods -n team-b --as=alice@example.com

kubectl auth can-i delete namespaces --as=alice@example.com





Comments

Post a Comment

Popular posts from this blog

NodeJS: Error: spawn EINVAL in window for node version 20.20 and 18.20

Encounter this issue when running autorest (that uses nodejs).  I am using node version:  v18.20.2 After i revert to use node v18.12.0, then i was able to get my app to run without this error. Since i am working with Azure devops yaml, i was able to use the following to resolve my issue.  - task : NodeTool@0   inputs :     versionSource : 'spec'     versionSpec : '18.18.0'
Read more

llama cpp running it in google colab

Image
There are 2 options to do this in Google  colab.  Option 1 (Easiest)  With this option, we can just install the relevant package and then run the model.  First we need to install the required packages using the following command:-  ! pip install -U llama-cpp-python Next,  we will try to get the model using the following command # !pip install llama-cpp-python from llama_cpp import Llama llm = Llama.from_pretrained(   repo_id= "unsloth/Qwen3-0.6B-GGUF" ,   filename= "Qwen3-0.6B-IQ4_NL.gguf" , ) We can see the model being downloaded:- And then we will run the following command to test this model llm.create_chat_completion(   messages = [     {       "role" : "user" ,       "content" : "What is the capital of France?"     }   ] ) And the output will look something like this:-  Option 2 llama.cpp is a powerful inference engine and if you wanted to get it running in google colab, you co...
Read more