Learn to grant least-privilege access in Kubernetes with RBAC, service accounts and CSR-issued certificates, with CKA-style labs and drills.
Picture a Bengaluru payments team and their CI pipeline. Months ago a build failed with Forbidden.
RBAC is four objects and one idea. The idea: permissions are only ever added, never taken away. There is no deny rule.
On the exam you will rarely write a Role from a blank file.
kubectl auth can-i asks the API server whether an identity may perform an action. It prints yes or no, and the exit code tells scripts the same thing.
A ServiceAccount is an identity for a process running in a pod, the way a user is an identity for a person.
A kubeconfig file tells kubectl which cluster to talk to and who to be. On the exam, every task begins by telling you which context to use.
Picture a Bengaluru payments team and their CI pipeline. Months ago a build failed with Forbidden.
RBAC is four objects and one idea. The idea: permissions are only ever added, never taken away. There is no deny rule.
On the exam you will rarely write a Role from a blank file.
kubectl auth can-i asks the API server whether an identity may perform an action.
A ServiceAccount is an identity for a process running in a pod, the way a user is an identity for a person.
A kubeconfig file tells kubectl which cluster to talk to and who to be.
Kubernetes can sign a client certificate for you, so a new engineer can authenticate without you handing out the...
Two topics sit next to access control and appear in exam tasks. This module keeps them short.
Access failures feel mysterious until you stop guessing.
Drills build the speed the exam rewards. Use imperative commands, look up anything unfamiliar in the official docs, and...
Scenario: Priya joins the payments team and needs to read pods. Arjun needs to manage Deployments.
RBAC command cheat sheet Common mistakes and how to avoid them Granting cluster-admin to silence an error This happens...
Roles that use the skills in this module.
DevOps Engineer
Site Reliability Engineer
Platform Engineer
Not a software engineer sheet. Every problem comes from real DevOps, SRE, Platform and Cloud interviews, from your first script to a system you build yourself.
Open the Coding SheetA Role lives in one namespace and can only grant access to resources in that namespace. A ClusterRole is not namespaced, so it can grant access to cluster-scoped resources such as nodes, or act as a reusable rule set that a RoleBinding applies inside a single namespace.
Run kubectl auth can-i with a verb and a resource, for example kubectl auth can-i list pods -n payments --as priya. Add --list to see every permission the identity has in a namespace. The --as flag needs permission to impersonate, which cluster admins normally have.
Modern Kubernetes no longer creates a permanent token Secret for every service account. Pods receive a short-lived projected token that the kubelet refreshes automatically. If you need a token for a script, run kubectl create token and give it a short duration.
Kubernetes has no built-in certificate revocation list. You remove the user's RoleBindings so the certificate proves identity but grants nothing, and you issue certificates with a short expiry. Rotating the cluster CA is the only way to invalidate every certificate at once.
No. Kubernetes does not store users. A user is simply the name that an authenticator extracts from a client certificate, a token or an identity provider, and RBAC binds permissions to that name.