Belajar IAM Engineer - Kubernetes & Workload Identity
Kubernetes service accounts, RBAC K8s, dan OIDC workload identity memastikan pod hanya memiliki akses yang dibutuhkan di cluster
#Pendahuluan
Setelah di episode 13 kita membahas Cloud IAM, pada episode ini kita masuk ke Kubernetes & workload identity — model akses di dalam cluster K8s yang mengelola bagaimana pod berinteraksi dengan cluster API dan resource eksternal.
Mengapa Kubernetes IAM penting? Karena K8s adalah platform container utama di production, dan setiap pod berjalan dengan identity tertentu. Tanpa RBAC yang benar, pod bisa mengakses resource yang tidak seharusnya — atau bahkan mengambil alih cluster.
#Kubernetes Service Accounts
#Konsep
Setiap pod berjalan dengan service account yang menentukan identity-nya di dalam cluster:
Pod "my-app" → Service Account "app-service-account"
→ Token untuk akses API server
→ Identity untuk cloud resource access#Default Service Account
kubectl get serviceaccounts -n default
kubectl describe serviceaccount default -n default#Custom Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
name: my-app-sa
namespace: production#Kubernetes RBAC
#Komponen RBAC K8s
| Komponen | Fungsi |
|---|---|
| Role | Permissions di satu namespace |
| ClusterRole | Permissions di seluruh cluster |
| RoleBinding | Menghubungkan Role ke user/service account |
| ClusterRoleBinding | Menghubungkan ClusterRole ke user/service account |
#Contoh Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-reader
namespace: production
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["pods/log"]
verbs: ["get"]#Contoh RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
namespace: production
subjects:
- kind: ServiceAccount
name: my-app-sa
namespace: production
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io#Workload Identity Federation
#Konsep
Workload identity menghubungkan service account K8s dengan identity cloud:
Pod (K8s SA) → OIDC Token → Cloud IAM (AWS/GCP/Azure) → Cloud Resources#AWS EKS + IRSA
# 1. Create IAM role with trust policy
aws iam create-role \
--role-name my-app-role \
--assume-role-policy-document '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Federated": "arn:aws:iam::ACCOUNT:oidc-provider/oidc.eks.REGION.amazonaws.com/id/CLUSTER_ID"},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"oidc.eks.REGION.amazonaws.com/id/CLUSTER_ID:sub": "system:serviceaccount:production:my-app-sa"
}
}
}]
}'
# 2. Attach policy
aws iam attach-role-policy --role-name my-app-role --policy-arn arn:aws:iam::policy/s3-read
# 3. Annotate K8s service account
kubectl annotate serviceaccount my-app-sa -n production \
eks.amazonaws.com/role-arn=arn:aws:iam::ACCOUNT:role/my-app-role#GKE Workload Identity
# 1. Create GCP service account
gcloud iam service-accounts create my-app-sa
# 2. Grant role ke GCP service account
gcloud projects add-iam-policy-binding PROJECT \
--member="serviceAccount:my-app-sa@PROJECT.iam.gserviceaccount.com" \
--role="roles/storage.objectViewer"
# 3. Bind K8s SA ke GCP SA
gcloud container clusters update CLUSTER \
--update-addons GcpDiskDriver=ENABLED
# 4. Annotate K8s service account
kubectl annotate serviceaccount my-app-sa -n production \
iam.gke.io/gcp-service-account=my-app-sa@PROJECT.iam.gserviceaccount.com#Pod Security Standards
#Security Context
apiVersion: v1
kind: Pod
metadata:
name: secure-pod
spec:
serviceAccountName: my-app-sa
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 2000
containers:
- name: app
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop: ["ALL"]Warning
Jangan gunakan default service account untuk pod produksi. Selalu buat custom service account dengan minimum permissions yang dibutuhkan. Default service account memiliki permissions yang terlalu luas.
#Security Scanning
#Tools
| Tool | Fungsi |
|---|---|
| Kubescape | Security posture assessment |
| Falco | Runtime security monitoring |
| Trivy | Image vulnerability scanning |
| kube-bench | CIS benchmark compliance |
# Install kube-bench
curl -L https://github.com/aquasecurity/kube-bench/releases/latest/download/kube-bench_linux_amd64 -o kube-bench
chmod +x kube-bench
./kube-bench run --targets master,node,policies#Penutup
Inti yang harus dibawa pulang:
- Setiap pod harus berjalan dengan custom service account, bukan default.
- K8s RBAC menggunakan Role/ClusterRole + RoleBinding/ClusterRoleBinding.
- Workload identity (IRSA, GKE WI) menghubungkan K8s SA dengan cloud IAM.
- Security scanning tools membantu menjaga posture keamanan cluster.
Di episode 15 selanjutnya kita akan membahas Customer IAM (CIAM) — customer identity, social login, dan registration flows. Siapkan customer-facing identity kalian!