Certified Kubernetes Administrator (CKA)
Notes - v1.27 (2023)
Kubernetes
3 min read
25%: Cluster Architecture, Installation & Configuration
Manage role based access control (RBAC)
RBAC in Kubernetes consists of the following descriptors.
Subjects
Subjects are the identity of the entity which can perform actions. For example,User, Group, Service Account.
Roles
Roles consist of:
- Verbs (actions):
create,delete,get,watch,list. - Resources (targets (GVK)):
pods,deployments.
# Role example.
# This role allows any subjects bound to it to `get` and `list` pods in the
# `my-app-environment` namespace.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: my-app-environment
name: read-pods
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
RoleBindings
RoleBindings binds given Subjects to a given Role.
# RoleBinding example.
# This rolebinding binds a User "Bob" to be able to read pods within the
# `my-app-environment` namespace.
apiVersion: rbac.authorizaton.k8s.io/v1
kind: RoleBinding
metadata:
namespace: my-app-environment
name: read-pods-bob
roleRef:
kind: Role
name: read-pods
apiGroup: rbac.authorization.k8s.io
subjects:
- kind: User
name: Bob
apiGroup: rbac.authorization.k8s.io
Use kubeadm to install a basic cluster
Reference: https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/
Node Prerequisites
- Unique MAC address
ip linkoripconfig -a. - Unique Product UUID
sudo cat /sys/class/dmi/id/product_uuid. - Swap Must be disabled.
kubeadm,kubelet,kubectlall installed with and maximum 1 minor version apart.
Ports
Required ports for the Control Plane:
| Protocol | Direction | Port Range | Purpose | Used by |
|---|---|---|---|---|
| TCP | Inbound | 6443 | Kubernetes API Server | All |
| TCP | Inbound | 2379-2380 | etcd Server client API | kube-apiserver, etcd |
| TCP | Inbound | 10250 | Kubelet API | Self, Control plane |
| TCP | Inbound | 10259 | kube-scheduler | Self |
| TCP | Inbound | 10257 | kube-controller-manager | Self |
Required ports for Worker nodes:
| Protocol | Direction | Port Range | Purpose | Used By |
|---|---|---|---|---|
| TCP | Inbound | 10250 | Kubelet API | Self, Control Plane |
| TCP | Inbound | 30000-32767 | NodePort Services | All |