Verifying RBAC

Let's give it a spin by creating the RBAC roles on Kubernetes and checking whether it actually works.

Creating the read-only user role

On the cloud shell, connect to your cluster.

Note that you have to specify --admin so that you can work on your cluster:

az aks get-credentials --resource-group handsonaks-rbac --name handsonaks-rbac --admin

Creating the cluster-wide, read-only role

Create the following file and save it as cluster-read-only-role.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
  name: read-only
rules...