Kubernetes Role-Based Access Control (RBAC) is a powerful mechanism that enables you to manage permissions within your cluster effectively. At times, a more complex permission scenario may require allowing `exec` access for troubleshooting while prohibiting other operations like `create` on resources such as pods. In this article, we explore how to configure RBAC to allow users to execute commands in pods without granting them permission to create new pods.

Understanding Kubernetes RBAC

RBAC is a method of regulating access to computer or network resources based on users' roles within an organization. In Kubernetes, RBAC is configured with four primary components:

1. Role: Specifies a set of permissions within a namespace.
2. RoleBinding: Grants the permissions defined in a Role to a user or a set of users.
3. ClusterRole: Similar to Role but is cluster-wide.
4. ClusterRoleBinding: Grants the cluster-wide permissions defined in a ClusterRole to a user or set of users.

Access Control for `pods/exec`

By default, executing commands in a pod using `kubectl exec` requires two primary permissions: `pods/exec` and `pods/get`. The `pods/get` permission ensures the user can retrieve information about the pod, while `pods/exec` is needed to initiate the command execution in the pod.

Example Role Definition

To define a Role that allows only `exec` and not `create` for pods, you need to specify these permissions precisely. Here's how:

• apiGroups: [""] # No API Group for core resources like pods
• kind: User
• Pods List Access: In cases where users need to locate the pod in which they should execute commands, it is essential to provide `list` and `get` permissions on `pods`.
• Security Review: Ensure this access aligns with your organization's security policies. Excessive permissions can lead to vulnerabilities.
• Audit Logs: Regularly review Kubernetes audit logs to monitor `exec` activities for any unauthorized actions.