How to gain least privileged access through Kubernetes Permissive RBAC permissions?

[raymak23]

Hello,

I came across Ocelot for running it as API gateway in Kubernetes cluster. I was going through Kubernetes documentation and I noticed that I have to execute below command to allow pod access to api server.

kubectl create clusterrolebinding permissive-binding –clusterrole=cluster-admin –user=admin –user=kubelet –group=system:serviceaccounts

Is above command necessary to expose all service accounts to have cluster admin privileges to api server? Below is what I read from kubernetes site.

Warning:
The following policy allows ALL service accounts to act as cluster administrators. Any application running in a container receives service account credentials automatically, and could perform any action against the API, including viewing secrets and modifying permissions. This is not a recommended policy.

Bit concerned about executing above command to allow ocelot pod to access api server. Kubernetes RBAC is not my strongest suit so wanted to check if anyone was able to modify above command with least privilege access?

Thanks,

Ray

[aashu4uiit]

It's an old thread so not sure if helpful to you but sharing for the community here. You don't have to give the role to all service account's if that's not required. You can use something like this to give this to a particular user or a service account.

kubectl create clusterrolebinding permissive-binding \
--clusterrole=cluster-admin \
--group=system:serviceaccount:namespace:serviceaccounta

[simontt]

Hi Ray! Also felt concerned about simply giving all service accounts cluster-admin, so did what @aashu4uiit recommended. Created a new service account specifically for my Ocelot API gateway, then added a ClusterRoleBinding of the "cluster-admin" cluster role to this new service account. Lastly, I referenced this service account in the deployment part of my manifest:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: api-gateway # create a new service account named api-gateway
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: api-gateway-cluster-admin
subjects:
- kind: ServiceAccount
  name: api-gateway
  namespace: default
  apiGroup: "" # "" for ServiceAccount subjects
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: ""
---
apiVersion: v1
kind: Service
metadata:
  name: <name>
spec:
  type: ClusterIP
  ports:
  - port: 80
    targetPort: 8080
  selector:
    app: <name>
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: <name>
spec:
  replicas: 1
  selector:
    matchLabels:
      app: <name>
  template:
    metadata:
      labels:
        app: <name>
    spec:
      serviceAccountName: api-gateway
      containers:
      - name: apigateway
        image: <image>
        imagePullPolicy: Always
        ports:
        - containerPort: 8080
      imagePullSecrets:
      - name: <pullsecret>
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: <name>
  annotations:
    kubernetes.io/ingress.class: nginx
spec:
  rules:
  - http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: <name>
            port:
              number: 80

Note that in my case, I also have an Ingress in front of the Ocelot gateway. Ideally, I'd actually look into what permissions Ocelot needs and then reduce the scope of the service account accordingly. That's on my backlog. 😜

[raman-m]

@raymak23 asked on Dec 13, 2020

Hi Ray!
Welcome to Ocelot world! 🐈‍⬛
Sorry for being silent for a 3 years from our side. Is your question still relevant?

[raman-m]

@RaynaldM We need your help! 🙏

[RaynaldM]

sorry we are not in this context ""running it as API gateway in Kubernetes cluster", we use NGINX