Namespaces and RBAC

---

1 - Namespaces

1.1 What is a Namespace?

A Namespace is a logical isolation mechanism that lets you divide a cluster's resources among multiple users or teams.

1.2 Default namespaces

Namespace	Description
default	Default namespace for resources
kube-system	Kubernetes system components
kube-public	Public resources accessible to all
kube-node-lease	Leases for node health

1.3 Create a Namespace

# Impératif
kubectl create namespace production

# Déclaratif
kubectl apply -f - <<EOF
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    env: production
    team: platform
EOF

# Lister les namespaces
kubectl get namespaces
kubectl get ns

1.4 Working with Namespaces

# Spécifier le namespace dans les commandes
kubectl get pods -n production
kubectl get all -n kube-system

# Définir le namespace par défaut
kubectl config set-context --current --namespace=production

# Vérifier le contexte actuel
kubectl config get-contexts

# Ressources dans tous les namespaces
kubectl get pods --all-namespaces
kubectl get pods -A

1.5 Resources and Namespaces

# Lister les ressources namespacées
kubectl api-resources --namespaced=true

# Lister les ressources cluster-wide
kubectl api-resources --namespaced=false

---

2 - Resource Quotas

2.1 Limit resources per Namespace

# resource-quota.yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: production-quota
  namespace: production
spec:
  hard:
    # Limites de compute
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    
    # Limites d'objets
    pods: "50"
    services: "10"
    secrets: "20"
    configmaps: "20"
    persistentvolumeclaims: "10"
    
    # Limites de stockage
    requests.storage: 100Gi

kubectl apply -f resource-quota.yaml
kubectl describe quota production-quota -n production

2.2 LimitRange

Defines default values and limits for containers.

# limit-range.yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: production
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "256Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"
    min:
      cpu: "50m"
      memory: "64Mi"
    max:
      cpu: "2"
      memory: "2Gi"
  - type: PersistentVolumeClaim
    min:
      storage: 1Gi
    max:
      storage: 50Gi

---

3 - RBAC (Role-Based Access Control)

3.1 RBAC concepts

Concept	Scope	Description
Role	Namespace	Permissions within a namespace
ClusterRole	Cluster	Cluster-wide permissions
RoleBinding	Namespace	Binds a Role to subjects
ClusterRoleBinding	Cluster	Binds a ClusterRole to subjects

3.2 Create a Role

# role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: pod-reader
rules:
- apiGroups: [""]  # "" = core API group
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get"]

---
# Role pour développeurs
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: development
  name: developer
rules:
- apiGroups: ["", "apps", "batch"]
  resources: ["pods", "deployments", "services", "configmaps", "jobs"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]  # Lecture seule pour les secrets

3.3 RBAC verbs

Verb	Description
get	Read a specific resource
list	List resources
watch	Watch for changes
create	Create a resource
update	Update a resource
patch	Partially modify
delete	Delete a resource
deletecollection	Delete multiple resources

3.4 Create a ClusterRole

# cluster-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

---
# ClusterRole pour admin namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-admin
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

3.5 RoleBinding

# role-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
# Utilisateur
- kind: User
  name: alice
  apiGroup: rbac.authorization.k8s.io
# Groupe
- kind: Group
  name: developers
  apiGroup: rbac.authorization.k8s.io
# ServiceAccount
- kind: ServiceAccount
  name: ci-bot
  namespace: production
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

3.6 ClusterRoleBinding

# cluster-role-binding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-binding
subjects:
- kind: User
  name: [email protected]
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin  # ClusterRole prédéfini
  apiGroup: rbac.authorization.k8s.io

---

4 - ServiceAccounts

4.1 What is a ServiceAccount?

A ServiceAccount provides an identity for processes running in a Pod.

# serviceaccount.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-service-account
  namespace: production
automountServiceAccountToken: true  # Monte le token automatiquement

4.2 Use a ServiceAccount

apiVersion: apps/v1
kind: Deployment
metadata:
  name: app
spec:
  template:
    spec:
      serviceAccountName: app-service-account
      containers:
      - name: app
        image: mon-app

4.3 ServiceAccount with permissions

# Création complète d'un ServiceAccount avec RBAC
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ci-runner
  namespace: ci-cd

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: ci-runner-role
  namespace: production
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "patch", "update"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "delete"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ci-runner-binding
  namespace: production
subjects:
- kind: ServiceAccount
  name: ci-runner
  namespace: ci-cd
roleRef:
  kind: Role
  name: ci-runner-role
  apiGroup: rbac.authorization.k8s.io

---

5 - Network Policies per Namespace

# Isoler le namespace production
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

---
# Autoriser le trafic interne au namespace
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-same-namespace
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector: {}  # Tous les pods du même namespace

---

6 - Audit and verification

6.1 Check permissions

# Vérifier si un utilisateur peut faire une action
kubectl auth can-i create pods -n production
kubectl auth can-i delete secrets -n production --as alice

# Vérifier toutes les permissions
kubectl auth can-i --list -n production
kubectl auth can-i --list -n production --as alice

# Vérifier pour un ServiceAccount
kubectl auth can-i get pods -n production --as system:serviceaccount:production:app-service-account

6.2 List permissions

# Voir les RoleBindings d'un namespace
kubectl get rolebindings -n production

# Voir les ClusterRoleBindings
kubectl get clusterrolebindings

# Détails d'un RoleBinding
kubectl describe rolebinding read-pods -n production

6.3 Predefined ClusterRoles

ClusterRole	Description
cluster-admin	Full access to the cluster
admin	Admin of a namespace (via RoleBinding)
edit	Read/write of most resources
view	Read-only

---

7 - RBAC best practices

7.1 Principle of least privilege

# MAUVAIS - Trop de permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: too-permissive
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

# BON - Permissions minimales nécessaires
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployment-manager
  namespace: production
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  resourceNames: ["my-app"]  # Ressource spécifique
  verbs: ["get", "patch"]

7.2 Use groups

# RoleBinding pour un groupe
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developers-access
  namespace: development
subjects:
- kind: Group
  name: developers  # Groupe LDAP/OIDC
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer
  apiGroup: rbac.authorization.k8s.io

7.3 RBAC security checklist

• Never grant cluster-admin unless absolutely necessary
• Avoid wildcards * in rules
• Use Roles instead of ClusterRoles when possible
• Audit permissions regularly
• Use dedicated ServiceAccounts per application
• Implement Network Policies as a complement

---

8 - Complete example: Multi-tenant

# Namespace pour l'équipe A
apiVersion: v1
kind: Namespace
metadata:
  name: team-a
  labels:
    team: alpha

---
# ResourceQuota
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-a-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    limits.cpu: "8"
    limits.memory: 16Gi
    pods: "20"

---
# LimitRange
apiVersion: v1
kind: LimitRange
metadata:
  name: team-a-limits
  namespace: team-a
spec:
  limits:
  - type: Container
    default:
      cpu: "200m"
      memory: "256Mi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"

---
# Role pour l'équipe
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: team-a-developer
  namespace: team-a
rules:
- apiGroups: ["", "apps", "batch"]
  resources: ["pods", "deployments", "services", "configmaps", "jobs", "cronjobs"]
  verbs: ["*"]
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "create"]
- apiGroups: [""]
  resources: ["persistentvolumeclaims"]
  verbs: ["get", "list", "create", "delete"]

---
# RoleBinding pour le groupe
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: team-a-developers
  namespace: team-a
subjects:
- kind: Group
  name: team-alpha-devs
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: team-a-developer
  apiGroup: rbac.authorization.k8s.io

---
# NetworkPolicy - Isolation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: isolate-namespace
  namespace: team-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          team: alpha
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          team: alpha
  - to:  # Autoriser DNS
    - namespaceSelector: {}
      podSelector:
        matchLabels:
          k8s-app: kube-dns
    ports:
    - protocol: UDP
      port: 53

---

Summary

In this chapter, we learned:

• Namespaces for logical isolation
• ResourceQuotas and LimitRanges for limits
• RBAC: Roles, ClusterRoles, Bindings
• ServiceAccounts for Pod identities
• Network Policies per namespace
• Security best practices

---

Next step

In the next chapter, we will put all of these concepts into practice with Exercises and Projects.

→ Next chapter: Exercises and Projects

---

← Back to the table of contents