CODEWITHSUNDEEP
kubernetes
Gaby
Gaby

Reputation: 235

how can you grant read-only access to the K8s dashboard?

I've tried creating a cluster role that only has access to view pods, however, for some reason that account can still see everything; secrets, deployments, nodes etc. I also enabled skip-login, and it seems like by default anonymous users don't have any restrictions either.

Service account:

apiVersion: v1
kind: ServiceAccount
metadata:
name: sa-example
namespace: default

Cluster Role:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-example
rules:
- apiGroups: [""] 
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Cluster Role Binding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crb-example
roleRef:
  apiGroup: rbac.authorization.k8s.io
  name: cr-example
  kind: ClusterRole
subjects:
  - kind: ServiceAccount
    name: sa-example
    namespace: default

Context:

K8s version: 1.17.3
Dashboard version: v2.0.0-rc5
Cluster type: bare metal
authorization-mode=Node,RBAC

Upvotes: 1

Views: 1593

Answers (1)

Jakub
Jakub

Reputation: 8830

How did You check if it works or no?

I made a reproduction of your issue with below yamls

apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-example
  namespace: default

---  

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-example
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]        

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crb-example
roleRef:
  apiGroup: rbac.authorization.k8s.io
  name: cr-example
  kind: ClusterRole
subjects:
  - kind: ServiceAccount
    name: sa-example
    namespace: default

And I used kubectl auth can-i to verify if it works 

kubectl auth can-i get pods   --as=system:serviceaccount:default:sa-example
yes
kubectl auth can-i get deployment   --as=system:serviceaccount:default:sa-example
no
kubectl auth can-i get secrets   --as=system:serviceaccount:default:sa-example
no
kubectl auth can-i get nodes   --as=system:serviceaccount:default:sa-example
no

And it seems like everything works just fine

The only thing which if different in my yaml is 

kind: ClusterRole
metadata:
  name: cr-example instead of cr-<role>

So it actually match ClusterRoleBinding

I hope it help you with your issues. Let me know if you have any more questions.

Upvotes: 1

Related Questions