WEBVTT

00:00.800 --> 00:01.800
In this lab,

00:01.881 --> 00:04.669
we'll go over ClusterRoles
and ClusterRoleBindings.

00:05.311 --> 00:08.561
For the first few questions of this lab,
you would have to inspect

00:08.642 --> 00:11.290
the existing ClusterRoles
and ClusterRoleBindings

00:11.714 --> 00:13.654
that have already been created.

00:13.735 --> 00:14.735
Let's go over that.

00:15.188 --> 00:17.988
How many ClusterRoles do you see
defined in the cluster?

00:18.204 --> 00:23.087
Let's do a kubectl get clusterroles.

00:25.558 --> 00:27.235
There seems to be a lot.

00:27.490 --> 00:32.170
We have the cluster-admin,
a lot of system clusterroles,

00:32.251 --> 00:34.342
and then a few others.

00:35.214 --> 00:38.802
We're going to count this
but we're not going to count it manually.

00:38.906 --> 00:40.771
We're going to do no-headers

00:42.002 --> 00:45.138
and then we're going to do a word count,

00:47.052 --> 00:49.334
wc -l.

00:49.886 --> 00:52.617
That's 69, so we're going to select 69.

00:55.673 --> 00:58.373
Now, how many ClusterRoleBindings
exist on the system?

00:58.547 --> 00:59.865
Let's do the same thing.

01:00.475 --> 01:03.270
We're going to get clusterrolebindings

01:04.858 --> 01:06.193
and that's 54.

01:10.487 --> 01:12.759
Now, what name namespace
is the cluster-admin

01:13.236 --> 01:14.335
clusterrole part of?

01:17.850 --> 01:21.819
If you do a kubectl get clusterroles,

01:23.846 --> 01:25.496
you'll see that they all are here

01:25.577 --> 01:29.206
but as we learned,
these are not namespace.

01:29.287 --> 01:31.566
ClusterRoles and ClusterRoleBindings
are not namespace.

01:31.647 --> 01:33.547
They're not specific to any namespace.

01:33.699 --> 01:36.699
ClusterRoles are cluster wide
and not part of any namespace.

01:36.780 --> 01:38.330
That's the correct answer here.

01:40.042 --> 01:44.882
Now, what user or groups
are the cluster-admin role bound to?

01:45.404 --> 01:48.304
The ClusterRoleBinding for the role
is with the same name.

01:48.385 --> 01:49.685
Let's take a look at that.

01:50.112 --> 01:51.112
Let's get

01:53.587 --> 01:57.109
clusterrolebindings

01:58.678 --> 02:04.833
and look for cluster-admin.

02:06.252 --> 02:09.512
The cluster-admin role is associated

02:09.593 --> 02:12.726
with the cluster-admin
clusterrolebinding.

02:13.266 --> 02:14.766
There are a few others as well

02:15.499 --> 02:17.349
but we're just going to look at this.

02:18.337 --> 02:25.334
Let's describe the clusterrolebindings
for cluster-admin.

02:26.172 --> 02:29.793
We see that it's part
of the group system:masters.

02:31.086 --> 02:32.686
It's asking the user and groups.

02:32.767 --> 02:34.326
We can also check this out.

02:34.407 --> 02:36.305
Let's check those out.

02:39.298 --> 02:42.198
As you can see,
they're associated with a service account.

02:43.181 --> 02:46.231
I'm guessing this is, too,
associated with a service account.

02:46.599 --> 02:47.799
We'll just focus on this

02:47.880 --> 02:51.730
and it's associated
with the system:masters group,

02:52.197 --> 02:54.177
so this is system:masters.

02:57.288 --> 03:00.709
Now, what level of permission
does the cluster-admin role grant?

03:01.168 --> 03:02.918
Let's take a look at that.

03:03.966 --> 03:10.680
kubectl describe clusterrole
and cluster-admin.

03:12.029 --> 03:17.887
We see that it's all *, *.* and *,*,*.

03:18.019 --> 03:23.075
* means all access to all resources.

03:23.234 --> 03:27.151
That's basically perform any action
on any resource in the cluster.

03:31.024 --> 03:34.119
Now, a new user, michelle,
joined the team.

03:34.453 --> 03:37.263
She will be focusing
on the nodes in the cluster.

03:37.344 --> 03:40.044
Create the required ClusterRole
and ClusterRoleBindings

03:40.125 --> 03:41.675
so she gets access to the node.

03:41.952 --> 03:47.156
Basically,
we're looking at kubectl get nodes

03:47.744 --> 03:49.998
but as the user michelle.

03:51.180 --> 03:53.280
As you can see, it says, "Nodes forbidden.

03:53.557 --> 03:57.442
User "michelle" cannot list
resource "nodes" in the API group."

03:59.571 --> 04:01.892
It does not give
any kind of specifications

04:01.973 --> 04:04.208
on the ClusterRole name or Rolebinding.

04:04.351 --> 04:08.770
Basically, we should be able to create
any role and rolebindings as we want.

04:10.022 --> 04:14.392
As long as this command works,
this exercise should be good.

04:14.473 --> 04:16.084
If there are no specifications given,

04:16.165 --> 04:19.323
we are free
to name things anything as we want.

04:20.098 --> 04:24.383
Let's do a kubectl create clusterrole.

04:25.971 --> 04:27.121
Let's look at the help.

04:28.587 --> 04:31.238
We see kubectl create clusterrole,

04:31.341 --> 04:32.341
then the name,

04:32.708 --> 04:34.854
followed by verb and resource.

04:35.498 --> 04:37.048
This is basically what we want.

04:41.960 --> 04:46.406
We're going to name this

04:47.490 --> 04:50.270
as michelle-role,

04:51.127 --> 04:53.745
and we should have a get, list, and watch,

04:53.826 --> 04:58.713
and the resource is nodes.

05:00.137 --> 05:01.137
Okay.

05:01.218 --> 05:03.537
Now we have to create
a ClusterRoleBinding,

05:04.403 --> 05:06.266
clusterrolebinding.

05:08.278 --> 05:09.378
Let's look at the help

05:10.813 --> 05:16.282
and so a ClusterRolebinding
binds a ClusterRole to a user.

05:16.894 --> 05:18.774
It's as simple as that.

05:20.528 --> 05:21.654
We're going to

05:26.369 --> 05:27.769
create a ClusterRoleBinding.

05:28.460 --> 05:29.608
We'll call this

05:33.974 --> 05:40.114
michelle-role-binding,

05:42.290 --> 05:45.927
and then we'll have ClusterRole,

05:47.689 --> 05:49.434
which is michelle-role.

05:49.594 --> 05:54.230
That's what we created
and the user is michelle.

05:55.270 --> 05:59.688
Let's take a look at that ClusterRole.

06:01.649 --> 06:03.611
Let's first look at the michelle-role

06:04.564 --> 06:07.284
and then let's look at your RoleBinding,

06:08.190 --> 06:10.799
which is michelle-role-binding.

06:11.823 --> 06:15.486
We have
get, list, and watch access to nodes.

06:16.017 --> 06:21.542
Then we have the michelle-role
associated with michelle user.

06:22.170 --> 06:24.664
Let's try the command again

06:25.593 --> 06:29.306
to test access so kubectl get nodes
--as michelle

06:30.402 --> 06:31.402
and that's working.

06:32.276 --> 06:34.405
Okay. Let's check our work.

06:35.517 --> 06:36.517
That's successful.

06:37.963 --> 06:39.213
Now, the next question is

06:39.294 --> 06:41.244
michelle's responsibilities are growing

06:41.325 --> 06:43.957
and now she will be responsible
for storage as well.

06:44.074 --> 06:46.424
Create
the required ClusterRole and RoleBindings

06:46.505 --> 06:48.376
to allow her access to storage,

06:49.391 --> 06:53.241
get the API groups and resource names
from the command kubectl api-resources.

06:54.398 --> 06:57.676
The kubectl api-resources command

06:59.565 --> 07:02.929
is a command that'll help you quickly--

07:07.612 --> 07:10.856
Let's just maximize this
so we can see it better.

07:11.484 --> 07:17.568
This command lists all the resources,
as well as their short names,

07:17.676 --> 07:19.633
so if you ever want to know

07:20.134 --> 07:23.232
what the short names are
for some of these,

07:23.634 --> 07:25.784
this is the command
that you should look at.

07:25.905 --> 07:30.461
Deployments have deploy because it has RS.

07:30.542 --> 07:31.542
That's one thing.

07:31.623 --> 07:32.948
It also list the API version

07:33.029 --> 07:35.050
so when you're creating an object,

07:35.131 --> 07:38.855
and if you're not sure
about the API version,

07:39.326 --> 07:41.276
this is something that you can look at,

07:41.357 --> 07:43.257
and also if they're namespaced or not.

07:43.338 --> 07:47.304
As we learned the persistentvolumes
and persistentvolumeclaims--

07:48.097 --> 07:49.097
I'm sorry.

07:49.183 --> 07:54.860
The ClusterRoleBindings are not namespaced
so you should be able to see those here.

07:55.993 --> 07:59.559
ClusterRoles and ClusterRoleBindings
are not namespaced

08:00.250 --> 08:05.577
and this is the kind that you would use
while creating a definition file.

08:06.260 --> 08:08.544
That's pretty neat.

08:08.625 --> 08:09.675
What we want to do is

08:14.400 --> 08:16.137
we want to create a ClusterRole

08:16.218 --> 08:20.613
to allow michelle
access to storageclasses.

08:21.298 --> 08:26.607
We will do a create clusterrole,

08:27.639 --> 08:33.144
the name is storage-admin,
so storage-admin,

08:33.834 --> 08:34.891
and the resource,

08:35.344 --> 08:36.544
there are two resources,

08:36.955 --> 08:39.654
persistentvolumes and storageclasses.

08:43.029 --> 08:48.582
First resource is persistentvolumes,

08:48.924 --> 08:50.248
let's get that,

08:51.820 --> 08:55.428
and storageclasses, let's get that.

09:01.163 --> 09:02.992
The verbs are,

09:03.977 --> 09:08.789
let's do list, create, get, and watch.

09:09.496 --> 09:11.619
Those are the four words that are used.

09:13.254 --> 09:14.404
Let's give this a shot.

09:15.864 --> 09:18.986
Okay, so it's created,
and let's check it out.

09:19.146 --> 09:25.135
Kubectl describe
clusterrole storage-admin.

09:29.350 --> 09:32.094
That's created the role.

09:38.326 --> 09:43.628
I want to look at the role
in the yaml format.

09:49.077 --> 09:51.177
We can see
that the ClusterRole is created,

09:51.258 --> 09:52.337
name storage-admin.

09:52.639 --> 09:53.639
There are two rules.

09:53.720 --> 09:56.695
It's created two rules,
one for each resource.

09:56.806 --> 10:00.409
You have persistentvolumes
and then you have storageclass.

10:01.846 --> 10:02.846
That's good.

10:02.920 --> 10:05.615
Now we have to create
the ClusterRoleBinding,

10:06.815 --> 10:07.815
which is this.

10:11.750 --> 10:16.367
Kubectl create clusterrole--

10:18.455 --> 10:20.581
The name is michelle-storage-admin.

10:22.796 --> 10:25.791
The user is michelle.

10:26.874 --> 10:32.247
The clusterrole is storage-admin.

10:35.390 --> 10:37.024
Lets take a look.

10:47.001 --> 10:51.422
We can see the ClusterRole
that is associated

10:51.503 --> 10:53.703
to a storage-admin
and the user is michelle.

10:53.996 --> 10:57.191
Lets do a kubectl --as michelle

10:58.033 --> 11:02.611
and we get storageclasses.

11:03.604 --> 11:06.244
You see that that's working as expected.

11:08.141 --> 11:09.357
That's about it.

11:09.667 --> 11:11.317
Well, that's the end of this lab.