Kubernetes provides mechanisms to authenticate and authorize access to its API. This allows us to apply different levels of privileges for users or roles within a cluster. This prevents unauthorized access to some core resources, such as scheduling or nodes in the cluster.
Once users are allowed to use cluster resources, we use namespaces to isolate their own resources from other users. This works even in multi-tenant environments where a higher level of security is required.
Kubernetes works with the very elaborate Role-Based Access Control (RBAC) environment, which provides a great level of granularity to allow specific actions on some resources while other actions are denied.
We manage the Role and ClusterRole resources to describe permissions for different resources. We use Role to define permissions within namespaces and ClusterRole for permissions on cluster-wide resources. Rules are supplied using some defined verbs, such as list, get...
