Kubernetes RBAC and Workload Security

In this lab you will secure access to a Kubernetes cluster by controlling both who can interact with it and what workloads are allowed to do once running. You will create cluster users from certificates and kubeconfigs, scope their access with Roles and ClusterRoles, give workloads their own identity with Service Accounts, and harden containers using Security Contexts. You will then enforce those standards automatically at the namespace level with Pod Security Admission.

Upon completion of this lab, you will be able to:

• Create cluster users by generating private keys and certificate signing requests, then signing them with the cluster certificate authority.
• Build kubeconfig files so each user has their own scoped access to the cluster.
• Create Roles and ClusterRoles and bind them to users to grant precisely the access they need.
• Apply the principle of least privilege by scoping permissions to namespaces and avoiding broad cluster-wide grants.
• Create and assign Service Accounts to give workloads their own identity instead of relying on the default.
• Harden workloads using Security Contexts to control privilege, user, and capabilities.
• Enforce workload security standards at the namespace level using Pod Security Admission.

Software and Virtual Hardware:

• 8 x Red Hat Enterprise Linux (RHEL) 9.6 VMs
• Kubernetes 1.34.1