[//]: # (Confidential document)
[//]: # (01/05/2025)
[//]: # (v 1.7.3)

# Kubernetes  labs v1.7.3
## Security :   RBAC


Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within your organization.

RBAC authorization uses the rbac.authorization.k8s.io API group to drive authorization decisions, allowing you to dynamically configure policies through the Kubernetes API.

To enable RBAC, start the API server with the --authorization-mode flag set to a comma-separated list that includes RBAC; 


## Lab1: RBAC

  - Create 
	- Namespace
	- Service Account
	- long-lived API token for a ServiceAccount
	- Role
	- RoleBinding
 - Get Roles, RoleBinding
 - Describe Roles
 - Check access using auth can-i 


```bash
kubectl create -f manifests/rbac.yaml
kubectl get ServiceAccount -n rbac
kubectl get Roles -n rbac
kubectl get RoleBinding -n rbac
kubectl describe Roles -n rbac
kubectl auth can-i get pods --as=system:serviceaccount:rbac:dev-service-account
kubectl auth can-i get cm --as=system:serviceaccount:rbac:dev-service-account
kubectl auth can-i get cm --as=system:serviceaccount:rbac:dev-service-account -n rbac
```

## Lab2: Kubeconfig

  - Generate Kubeconfig
    Usage ./kubeconfig.sh ( namespace ) ( service account name ) ( secret name )
```
dos2unix manifests/kubeconfig.sh
chmod +x manifests/kubeconfig.sh
./manifests/kubeconfig.sh rbac dev-service-account dev-secret
kubectl --kubeconfig=kubeconfig-rbac get po
kubectl --kubeconfig=kubeconfig-rbac get cm 
kubectl --kubeconfig=kubeconfig-rbac get cm  -n rbac
```

## Lab3: Token

The token is a JSON Web Token (JWT), encoded as base64 as specified in the JWT RFC.
jwt.io is a useful tool to decode JWT. 

  - Generate Token
  - Manually create an API token for a ServiceAccount
```
kubectl run --restart=Never busybox -it --image=busybox --rm --quiet -- \
cat /var/run/secrets/kubernetes.io/serviceaccount/token


kubectl create ns dev2
kubectl create sa demo -n dev2
kubectl create token demo -n dev2
kubectl create token demo --duration=999999h -n dev2
```



## Clean up
```bash
kubectl delete -f manifests/rbac.yaml
kubectl delete ns dev2 
```