RBAC Cluster EKS

0

Goodnight,

I need help. Today for authentication in my EKS cluster I add the user or role in the aws_auth file and I only have the system:masters group configured. How do I create a new group with more restricted permissions on the cluster?

Flavio
asked a month ago147 views
1 Answer
3
Accepted Answer

Step 1: Define a New Kubernetes Role or ClusterRole First, you need to define what permissions the new group should have. You can create a Role for namespace-specific permissions or a ClusterRole for cluster-wide permissions. Here's an example of how to define a ClusterRole with restricted permissions:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: custom-restricted-role
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

This ClusterRole allows users only to get, list, and watch pods across the cluster.

Step 2: Create a ClusterRoleBinding or RoleBinding To assign the ClusterRole to a group, you use a ClusterRoleBinding (or RoleBinding for a Role). For example:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: custom-restricted-role-binding
subjects:
- kind: Group
  name: custom-group
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: custom-restricted-role
  apiGroup: rbac.authorization.k8s.io

Step 3: Update the aws-auth ConfigMap Now, you need to map AWS IAM roles or users to the new Kubernetes group in the aws-auth ConfigMap. Here’s how you update it:

mapRoles: |
  - rolearn: arn:aws:iam::<AWS_ACCOUNT_ID>:role/<ROLE_NAME>
    username: <ROLE_NAME>
    groups:
      - custom-group

For an IAM user, the entry would be similar but under mapUsers.

profile picture
EXPERT
answered a month ago
profile picture
EXPERT
Artem
reviewed a month ago
profile picture
EXPERT
reviewed a month ago
  • Thanks for the answer. In steps one and two, is it necessary to create a new file with the informed settings or do I edit an existing file? Is there a list where I can see all existing cluster roles in the cluster's RBAC?

  • You create a new manifest file and apply it. After that, the data goes to the Kubernetes configuration via API

    if you use "kubectl" util, you can execute the following command to see all existing cluster roles

    kubectl get clusterroles

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions