Kubernetes Simulator
intermediate · ~10 min
A key for the robot
The checkout team's CI pipeline deploys by running kubectl. Right now it borrows an admin's credentials — which could read the payment keys and wreck the search team's namespace.
Give it its own identity: a ServiceAccount, ci, in checkout. On its own it may do nothing. A Role lists what may be done (verbs on resources) in one namespace; a RoleBinding grants a Role to a subject. kubectl auth can-i VERB RESOURCE --as=system:serviceaccount:checkout:ci -n NS asks the API server as the robot.
Objectives
- CI can create, update and patch deployments in checkout
- …but can't read secrets, or touch search
- Check its rights with kubectl auth can-i --as
- Bonus: Watch the robot get turned away from the payment keys
Best on a computer with a keyboard. It works on a phone, with shortcuts under the terminal.