Kubernetes Simulator
intermediate · ~8 min
Look, don't touch
alice joins the on-call rota. She needs to see what runs in both team namespaces — pods, deployments, events — without being able to change anything, or to read the payment keys.
You don't need to write a Role for this. Kubernetes ships ClusterRoles for the common cases: view (read everything but Secrets), edit, admin. A RoleBinding in a namespace can grant a ClusterRole there, and only there.
Objectives
- alice can list pods and deployments in checkout and search
- …but can't read secrets or change anything
- Bonus: Try it as alice: kubectl get pods --as=alice
Best on a computer with a keyboard. It works on a phone, with shortcuts under the terminal.