Configure Kubernetes RBAC with service accounts and cluster roles for secure access control

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
NAMESPACE="${1:-rbac-demo}"
TEMP_DIR=""

# Usage message
usage() {
    echo "Usage: $0 [namespace]"
    echo "  namespace: Kubernetes namespace for RBAC demo (default: rbac-demo)"
    echo "Example: $0 my-rbac-test"
    exit 1
}

# Cleanup function
cleanup() {
    local exit_code=$?
    if [[ $exit_code -ne 0 ]]; then
        echo -e "${RED}[ERROR] Script failed. Cleaning up...${NC}"
        if [[ -n "$TEMP_DIR" && -d "$TEMP_DIR" ]]; then
            rm -rf "$TEMP_DIR"
        fi
        if kubectl get namespace "$NAMESPACE" &>/dev/null; then
            echo -e "${YELLOW}[CLEANUP] Removing namespace $NAMESPACE...${NC}"
            kubectl delete namespace "$NAMESPACE" --ignore-not-found=true
        fi
    fi
    if [[ -n "$TEMP_DIR" && -d "$TEMP_DIR" ]]; then
        rm -rf "$TEMP_DIR"
    fi
}

# Error handler
error_handler() {
    echo -e "${RED}[ERROR] Command failed on line $1${NC}"
    cleanup
    exit 1
}

trap 'error_handler ${LINENO}' ERR
trap cleanup EXIT

# Progress counter
STEP=1
TOTAL_STEPS=8

progress() {
    echo -e "${BLUE}[$STEP/$TOTAL_STEPS] $1${NC}"
    ((STEP++))
}

success() {
    echo -e "${GREEN}[SUCCESS] $1${NC}"
}

warning() {
    echo -e "${YELLOW}[WARNING] $1${NC}"
}

# Check if argument is help
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
    usage
fi

# Validate namespace name
if [[ ! "$NAMESPACE" =~ ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ ]]; then
    echo -e "${RED}[ERROR] Invalid namespace name. Must be lowercase alphanumeric with hyphens.${NC}"
    exit 1
fi

progress "Checking prerequisites and detecting system..."

# Check if running as root or with sudo
if [[ $EUID -eq 0 ]]; then
    warning "Running as root. This script should be run as a regular user with kubectl access."
fi

# Detect distribution
if [[ ! -f /etc/os-release ]]; then
    echo -e "${RED}[ERROR] Cannot detect Linux distribution${NC}"
    exit 1
fi

. /etc/os-release
case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_INSTALL="apt install -y"
        PKG_UPDATE="apt update"
        ;;
    almalinux|rocky|centos|rhel|ol|fedora)
        PKG_MGR="dnf"
        PKG_INSTALL="dnf install -y"
        PKG_UPDATE="dnf check-update || true"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_INSTALL="yum install -y"
        PKG_UPDATE="yum check-update || true"
        ;;
    *)
        echo -e "${RED}[ERROR] Unsupported distribution: $ID${NC}"
        exit 1
        ;;
esac

echo "Detected distribution: $PRETTY_NAME"
echo "Package manager: $PKG_MGR"

# Check for kubectl
if ! command -v kubectl &> /dev/null; then
    echo -e "${RED}[ERROR] kubectl is not installed. Please install kubectl first.${NC}"
    exit 1
fi

progress "Verifying Kubernetes cluster access and RBAC..."

# Check cluster access
if ! kubectl cluster-info &> /dev/null; then
    echo -e "${RED}[ERROR] Cannot connect to Kubernetes cluster. Check your kubeconfig.${NC}"
    exit 1
fi

# Check RBAC status
if ! kubectl auth can-i list pods --as=system:anonymous &> /dev/null; then
    success "RBAC is properly enabled (anonymous access denied)"
else
    warning "RBAC might not be properly configured (anonymous access allowed)"
fi

# Check authorization mode
AUTH_MODE=$(kubectl cluster-info dump 2>/dev/null | grep -i "authorization-mode" | head -1 || echo "")
if [[ "$AUTH_MODE" == *"RBAC"* ]]; then
    success "RBAC authorization mode is enabled"
else
    warning "Could not verify RBAC authorization mode"
fi

progress "Creating namespace: $NAMESPACE..."

# Create namespace
kubectl create namespace "$NAMESPACE" --dry-run=client -o yaml | kubectl apply -f -
success "Namespace $NAMESPACE created or already exists"

progress "Creating temporary directory and YAML files..."

TEMP_DIR=$(mktemp -d)
chmod 755 "$TEMP_DIR"

# Create service accounts YAML
cat > "$TEMP_DIR/serviceaccounts.yaml" << 'EOF'
apiVersion: v1
kind: ServiceAccount
metadata:
  name: pod-reader
  namespace: NAMESPACE_PLACEHOLDER
  labels:
    app: rbac-demo
    role: reader
  annotations:
    description: "Service account for reading pod information"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: deployment-manager
  namespace: NAMESPACE_PLACEHOLDER
  labels:
    app: rbac-demo
    role: manager
  annotations:
    description: "Service account for managing deployments"
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cluster-admin-sa
  namespace: NAMESPACE_PLACEHOLDER
  labels:
    app: rbac-demo
    role: admin
  annotations:
    description: "Service account with cluster-wide admin privileges"
EOF

# Replace namespace placeholder
sed -i "s/NAMESPACE_PLACEHOLDER/$NAMESPACE/g" "$TEMP_DIR/serviceaccounts.yaml"

# Create cluster roles YAML
cat > "$TEMP_DIR/clusterroles.yaml" << 'EOF'
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader-role
  labels:
    app: rbac-demo
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/log"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployment-manager-role
  labels:
    app: rbac-demo
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-admin-role
  labels:
    app: rbac-demo
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["apps"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["extensions"]
  resources: ["*"]
  verbs: ["*"]
EOF

# Create roles YAML
cat > "$TEMP_DIR/roles.yaml" << 'EOF'
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: NAMESPACE_PLACEHOLDER
  name: secret-manager
  labels:
    app: rbac-demo
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
EOF

sed -i "s/NAMESPACE_PLACEHOLDER/$NAMESPACE/g" "$TEMP_DIR/roles.yaml"

# Create bindings YAML
cat > "$TEMP_DIR/bindings.yaml" << 'EOF'
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pod-reader-binding
  labels:
    app: rbac-demo
subjects:
- kind: ServiceAccount
  name: pod-reader
  namespace: NAMESPACE_PLACEHOLDER
roleRef:
  kind: ClusterRole
  name: pod-reader-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: deployment-manager-binding
  labels:
    app: rbac-demo
subjects:
- kind: ServiceAccount
  name: deployment-manager
  namespace: NAMESPACE_PLACEHOLDER
roleRef:
  kind: ClusterRole
  name: deployment-manager-role
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: secret-manager-binding
  namespace: NAMESPACE_PLACEHOLDER
  labels:
    app: rbac-demo
subjects:
- kind: ServiceAccount
  name: cluster-admin-sa
  namespace: NAMESPACE_PLACEHOLDER
roleRef:
  kind: Role
  name: secret-manager
  apiGroup: rbac.authorization.k8s.io
EOF

sed -i "s/NAMESPACE_PLACEHOLDER/$NAMESPACE/g" "$TEMP_DIR/bindings.yaml"

# Set proper permissions
chmod 644 "$TEMP_DIR"/*.yaml

progress "Applying service accounts..."
kubectl apply -f "$TEMP_DIR/serviceaccounts.yaml"
success "Service accounts created successfully"

progress "Applying cluster roles..."
kubectl apply -f "$TEMP_DIR/clusterroles.yaml"
success "Cluster roles created successfully"

progress "Applying namespace roles..."
kubectl apply -f "$TEMP_DIR/roles.yaml"
success "Namespace roles created successfully"

progress "Applying role bindings..."
kubectl apply -f "$TEMP_DIR/bindings.yaml"
success "Role bindings created successfully"

progress "Verifying RBAC configuration..."

echo ""
echo "=== Service Accounts ==="
kubectl get serviceaccounts -n "$NAMESPACE" -l app=rbac-demo

echo ""
echo "=== Cluster Roles ==="
kubectl get clusterroles -l app=rbac-demo

echo ""
echo "=== Roles ==="
kubectl get roles -n "$NAMESPACE" -l app=rbac-demo

echo ""
echo "=== Cluster Role Bindings ==="
kubectl get clusterrolebindings -l app=rbac-demo

echo ""
echo "=== Role Bindings ==="
kubectl get rolebindings -n "$NAMESPACE" -l app=rbac-demo

echo ""
echo "=== Testing Permissions ==="
# Test pod-reader permissions
if kubectl auth can-i list pods --as=system:serviceaccount:$NAMESPACE:pod-reader; then
    success "pod-reader can list pods (as expected)"
else
    warning "pod-reader cannot list pods (unexpected)"
fi

# Test deployment-manager permissions
if kubectl auth can-i create deployments --as=system:serviceaccount:$NAMESPACE:deployment-manager; then
    success "deployment-manager can create deployments (as expected)"
else
    warning "deployment-manager cannot create deployments (unexpected)"
fi

echo ""
success "RBAC configuration completed successfully!"
echo ""
echo "Next steps:"
echo "1. Test the service accounts with actual workloads"
echo "2. Use 'kubectl auth can-i' to verify specific permissions"
echo "3. Monitor cluster logs for authorization events"
echo ""
echo "Example commands:"
echo "  kubectl auth can-i list pods --as=system:serviceaccount:$NAMESPACE:pod-reader"
echo "  kubectl auth can-i create secrets --as=system:serviceaccount:$NAMESPACE:cluster-admin-sa -n $NAMESPACE"
echo ""
echo "To clean up:"
echo "  kubectl delete namespace $NAMESPACE"
echo "  kubectl delete clusterrole pod-reader-role deployment-manager-role namespace-admin-role"
echo "  kubectl delete clusterrolebinding pod-reader-binding deployment-manager-binding"