CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

RBAC Fundamentals

RBAC is 30% of the KCSA pool by keyword, more than any other subject. This guide builds the smallest possible working example - a ServiceAccount, a Role, a RoleBinding - and then tests the four edges that define what it can reach.

Security Fundamentals Guide 18 of 42 Beginner

Written against the versions above. RBAC is stable API. `kubectl auth can-i --as=` impersonation needs the `impersonate` verb, which cluster-admin has; it is the fastest audit tool in Kubernetes.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

Before you start

  1. An identity with nothing

  2. One Role, one binding, one permission

  3. The four edges

Official sources

← All KCSA guides