I am trying to find our the minimum privileges required for application to communicate in kubernetes for the below scenarios
I have deployed an sample application in my cluster (https://github.com/kubernetes/kubernetes/tree/release-1.2/examples/guestbook) in two different namespaces
However tough I associate these applications with service account have no privileges in respective namespaces , my php application is still able to reach redis application. I was expecting it to throw an error , how are my applications functioning even after giving my service account no roles
Below is the role i associated with my service account
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
name: no-access-cr
rules:
- apiGroups: [""] # "" indicates the core API group
resources: [""]
verbs: [""]
Kindly assist!!!
RBAC policies that you're applying to applications have nothing to do with networking (L3/L4) itself. They are related to L7 access to k8s APIs (kube-api server) and therefore access to k8s objects exposed via these APIs.
If you want to restrict access between the apps on networking level (L3/L4) you need to apply network policies Also depending on network plugin e.g. calico policies can be used.