K
Q

How to assign RBAC permissions to system:anonymous service account in Kubernetes?

3/23/2020

How to assign RBAC permissions to system:anonymous service account in Kubernetes?

To understand Kubernetes, I want to assign permissions to the system:anonymous service account to review permissions using kubectl auth can-i --list.

I have created the following role and rolebinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole 
metadata:
  name: anonymous-review-access
rules:
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
   name: anonymous-review-access
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: anonymous-review-access
subjects:
- kind: ServiceAccount
  name: anonymous
  namespace: default

After kubectl apply -f ... the above, I'm still not allowed to review access permissions anonymously:

$ kubectl auth can-i --list --as=system:anonymous -n default
Error from server (Forbidden): selfsubjectrulesreviews.authorization.k8s.io is forbidden: User "system:anonymous" cannot create resource "selfsubjectrulesreviews" in API group "authorization.k8s.io" at the cluster scope

How can I create proper role and rolebinding to view permissions as system:anonymous service account?

-- Shuzheng
cloud
docker
kubernetes

Similar Questions

RabbitMQ fails to start after restart Kubernetes cluster
How to mount volume from my container in kubenetes
Kubernetes HPA wrong metrics?
Resuming spark job on failure of master pod in k8s

1 Answer

3/23/2020

system:anonymous is not a service account.Requests that are not rejected by other configured authentication methods are treated as anonymous requests, and given a username of system:anonymous and a group of system:unauthenticated

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anonymous-review-access
rules:
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - create
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
   name: anonymous-review-access
roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
   name: anonymous-review-access
subjects:
- kind: User
  name: system:anonymous
  namespace: default
    kubectl auth can-i --list --as=system:anonymous -n default
Resources                                       Non-Resource URLs   Resource Names   Verbs
selfsubjectaccessreviews.authorization.k8s.io   []                  []               [create]
selfsubjectrulesreviews.authorization.k8s.io    []                  []               [create]
-- Arghya Sadhu
Source: StackOverflow