K8s Namespace:

• A namespace is a logical parition inside k8s. it will create multiple teams and projects

Ex: Namespaces

1. frontend
2. bacckend
3. monitoring
4. network

Default Namespaces

1. Default namespace : used for when no namespace is specificed
2. kube-system : k8s componets will be runing on it (coreDNS, Kube-proxy…etc)
3. Kube-public: Publicly readable (rarely used)
4. kube-node-lease: node hartbeats (logs coolection)

basic commands:

# Create namespace
kubectl create ns dev 

# get all namespace 
kubectl get ns

# Delete namespace 
Kubectl delete ns <namespace>
# Note when delete ns it will delete all configuire deploy on namespace

apiVersion: v1
kind: Namespace
metadata:
  labels:
    kubernetes.io/metadata.name: dev
  name: dev

apiVersion: apps/v1
kind: Deployment
metadata:
  name: recreate-deployment-app
  namespace: dev
  labels:
    app: apache2
spec:
  replicas: 2
  selector:
    matchLabels:
      app: apache2
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: apache2
    spec:
      containers:
        - name: apache2
          image: httpd:2 # 2.4.69
          ports:
            - containerPort: 80

Create ns and deploy above yaml file

Uses:

1. isolation: create separate workspace (env, team, project)
2. Name Scoping: deploy same app with same name using namespace
3. Access_control: RBAC (permissions managed by Namespace level) (scope: rwd kind)
4. Resource limits: apply resource quota and limit range per namespace (cpu, memory)

Service Account:

• A ServiceAccount is an identity for processes running in Pods (not human)
• when pods want to talk to k8s api (ex: read configmap, secrets)

identity typs:

1. service account ==> pod/application level
2. user account ==> (kubectl/admins) humans (external)

Key Facts:

• service accounts are namespaces.
• Every Namespace having default service account
• every service account default does not have permissions
• from K8s 1.24+ auto-rotate secrets token (STS)

# get all service account in dev namespace 
kubectl get sa -n dev

# Create ServiceAccount in dev namespace
kubectl create sa devops -n dev

apiVersion: v1
kind: ServiceAccount
metadata:
  name: devops
  namespace: dev

How Its works:

Example:

1. Create namespace

kubectl create ns demo

2. create serviceAccount

• create sa.yaml file and insert below yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: pod-read-sa
  namespace: demo

• kubectl apply -f sa.yaml

2. role

• create yaml role.yaml add below data

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: demo
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "watch", "list"]

• create role kubectl apply -f role.yaml
• get role kubectl get role -n demo
• refer Types of verbs
• policy role in k8s offical docs

3. rolebinding

• offical docs
• create rb.yaml and add below data

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-reader-role-binding
  namespace: demo
subjects:
  - kind: ServiceAccount
    name: pod-read-sa
    namespace: demo
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

• create rolebinding kubectl apply -f rb.yaml

4. attach sa to pod

apiVersion: apps/v1
kind: Deployment
metadata:
  name: recreate-deployment-app
  namespace: demo
  labels:
    app: apache2
spec:
  replicas: 2
  selector:
    matchLabels:
      app: apache2
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: apache2
    spec:
      serviceAccountName: pod-read-sa
      containers:
        - name: apache2
          image: httpd:2.4.69
          ports:
            - containerPort: 80

• create pod with Sa kubectl apply -f deployment.yaml
• Verify pod attached serviceAccount kubectl get pods -n demo <podName> -o yaml | grep serviceAccountName

# check get
kubectl auth can-i get pods \
  --as=system:serviceaccount:demo:pod-read-sa -n demo

# check list
kubectl auth can-i list pods \
  --as=system:serviceaccount:demo:pod-read-sa -n demo

# watch
kubectl auth can-i watch pods \
  --as=system:serviceaccount:demo:pod-read-sa -n demo

# Check all once 
kubectl auth can-i get,list,watch pods \
  --as=system:serviceaccount:demo:pod-read-sa -n demo

---

TASK

• Create namespace devops and serviceAccount devops-sa and create basic role qt-role and add perssions get,watch,list,update and create rolebinding qt-role-binding and finally attach service account deploy nginx and verify with above cmds.