How to: Authentication, Role Based Access Control, Service Account <a name="authentication"></a>
#### Authentication 
- It is related to authenticate user to use specific cluster. 
- Theory of the creating authentication is explained in short:
    - user creates .key (key file) and .csr (certificate signing request file includes username and roles) with openssl application
    - user sends .csr file to the K8s admin
    - K8s admin creates a K8s object with this .csr file and creates .crt file (certification file) to give user
    - user gets this .crt file (certification file) and creates credential (set-credentials) in user's pc with certification. 
    - user creates context (set-context) with cluster and credential, and uses this context.
    - now it requires to get/create authorization for the user.

#### Role Based Access Control (RBAC, Authorization) 
- It provides to give authorization (role) to the specific user. 
- "Role", "RoleBinding" K8s objects are used to bind users for specific "namespace". 
- "ClusterRole", "ClusterRoleBinding" K8s objects are used to bind users for specific "namespace". 

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]                            # "" indicates the core API group
  resources: ["pods"]                        # "services", "endpoints", "pods", "pods/log" etc.
  verbs: ["get", "watch", "list"]            # "get", "list", "watch", "create", "update", "patch", "delete"  
``` 

![image](https://user-images.githubusercontent.com/10358317/154953311-84f616cf-3a25-486f-beb9-e2d6a3a2e01a.png)

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: username@hostname.net                 # "name" is case sensitive, this name was defined while creating .csr file
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role #this must be Role or ClusterRole
  name: pod-reader                            # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io    
```
    
![image](https://user-images.githubusercontent.com/10358317/154953439-1dd52309-611b-48bf-8f7b-51433b678f8c.png)

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]    
```  
    
![image](https://user-images.githubusercontent.com/10358317/154953542-3723d691-632e-41d6-908f-5b15080ffa7b.png)

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: DevTeam                              # Name is case sensitive
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io 
```
    
![image](https://user-images.githubusercontent.com/10358317/154953630-dcd71073-6de6-4194-955e-9b50a0f9c978.png)
    
#### Service Account
- RBACs are used for real people. 
- Service accounts are used for pods/apps that can connect K8s API to create K8s objects.