# \#authz **URL:** https://discuss.kubernetes.io/tag/authz/18.md [Latest](https://discuss.kubernetes.io/latest.md) · [Categories](https://discuss.kubernetes.io/categories.md) · [Tags](https://discuss.kubernetes.io/tags.md) --- ## [Why having a ClusterRoleBinding for \`system:masters\` when it has unrestricted privilege without RBAC](https://discuss.kubernetes.io/t/why-having-a-clusterrolebinding-for-system-masters-when-it-has-unrestricted-privilege-without-rbac/30059)
**Author:** [@agileshaw](https://discuss.kubernetes.io/u/agileshaw)\ **Replies:** 0\ **Last updated:** [October 10, 2024, 3:41am UTC](https://discuss.kubernetes.io/t/why-having-a-clusterrolebinding-for-system-masters-when-it-has-unrestricted-privilege-without-rbac/30059 "2024-10-10T03:41:15Z")
Hi team, I have a general question about the authentication of the special group system:masters. When RBAC is enabled, there is a ClusterRoleBinding, cluster-admin, auto-created by the cluster that binds system:masters … --- ## [What is the proper way to allow impersonating a single service account in k8s via RBAC?](https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168)
**Author:** [@L1ghtman2k](https://discuss.kubernetes.io/u/L1ghtman2k)\ **Replies:** 1\ **Last updated:** [February 7, 2024, 9:18am UTC](https://discuss.kubernetes.io/t/what-is-the-proper-way-to-allow-impersonating-a-single-service-account-in-k8s-via-rbac/24168 "2024-02-07T09:18:12Z")
I would like a cluster role or a service role to be able to impersonate a role in a different. I have tried both apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: creationTimestamp: "2023-05-10T23:… --- ## [Add custom claims into bound service account JWT token?](https://discuss.kubernetes.io/t/add-custom-claims-into-bound-service-account-jwt-token/21733)
**Author:** [@awn](https://discuss.kubernetes.io/u/awn)\ **Replies:** 0\ **Last updated:** [October 24, 2022, 4:31pm UTC](https://discuss.kubernetes.io/t/add-custom-claims-into-bound-service-account-jwt-token/21733 "2022-10-24T16:31:22Z")
I have a k8s cluster in EKS where pods are assigned bound service account tokens like so: volumeMounts: - mountPath: /test name: test readOnly: true ... volumes: - name: test projected: … --- ## [What is the equivalent of: kubectl auth can-i prune \?](https://discuss.kubernetes.io/t/what-is-the-equivalent-of-kubectl-auth-can-i-prune-resource-type/17465)
**Author:** [@L1ghtman2k](https://discuss.kubernetes.io/u/L1ghtman2k)\ **Replies:** 1\ **Last updated:** [September 18, 2021, 4:55am UTC](https://discuss.kubernetes.io/t/what-is-the-equivalent-of-kubectl-auth-can-i-prune-resource-type/17465 "2021-09-18T04:55:01Z")
Is there a way for me to determine if the current user has access to prune a given resource? My initial thought process was that prune is internally subdivided into delete/list operations, but I am not sure if that is a… --- ## [K8s Identity Lab - OpenID Connect, RBAC and PodSecurityPolicies](https://discuss.kubernetes.io/t/k8s-identity-lab-openid-connect-rbac-and-podsecuritypolicies/8907)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [December 3, 2019, 2:15pm UTC](https://discuss.kubernetes.io/t/k8s-identity-lab-openid-connect-rbac-and-podsecuritypolicies/8907 "2019-12-03T14:15:32Z")
We recently hosted a training course on kubernetes identity management for the BSidesDC conference. Part of that course was a lab that walked students through the process of setting up OpenID Connect, enabling RBAC and a… --- ## [Using GitHub to Manage Access for Kubernetes](https://discuss.kubernetes.io/t/using-github-to-manage-access-for-kubernetes/7231)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [July 22, 2019, 10:15am UTC](https://discuss.kubernetes.io/t/using-github-to-manage-access-for-kubernetes/7231 "2019-07-22T10:15:48Z")
In our latest blog post I walk through our new Orchestra Login Portal with GitHub to use your GitHub organizations to authenticate access to your cluster and use GitHub teams to manage access via RBAC. https://www.tremo… --- ## [Kubernetes Security Myths Debunked](https://discuss.kubernetes.io/t/kubernetes-security-myths-debunked/6909)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [June 24, 2019, 12:58pm UTC](https://discuss.kubernetes.io/t/kubernetes-security-myths-debunked/6909 "2019-06-24T12:58:47Z")
I have lots of discussions with folks about different aspects of k8s security. I took some time to talk about several of the myths I hear - https://www.tremolosecurity.com/kubernetes-security-myths-debunked/ . Would be … --- ## [Limit GitHub authentication](https://discuss.kubernetes.io/t/limit-github-authentication/6294)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [May 12, 2019, 12:43pm UTC](https://discuss.kubernetes.io/t/limit-github-authentication/6294 "2019-05-12T12:43:17Z")
If you’re using GitHub for authentication to your clusters, how are you limiting access to you GitHub organization? --- ## [Integrate Canonical Kubernetes (CDK) with Active Directory using OpenUnison](https://discuss.kubernetes.io/t/integrate-canonical-kubernetes-cdk-with-active-directory-using-openunison/3669)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 1\ **Last updated:** [December 3, 2018, 5:11pm UTC](https://discuss.kubernetes.io/t/integrate-canonical-kubernetes-cdk-with-active-directory-using-openunison/3669 "2018-12-03T17:11:21Z")
We just published a blog on integrating the CDK with Active Directory using our open source project OpenUnison - https://www.tremolosecurity.com/kubernetes-and-active-directory-with-canonical/. We talk you through step-… --- ## [New Open Source Login Portal for Kubernetes](https://discuss.kubernetes.io/t/new-open-source-login-portal-for-kubernetes/3292)
**Author:** [@marc.boorshtein](https://discuss.kubernetes.io/u/marc.boorshtein)\ **Replies:** 0\ **Last updated:** [October 29, 2018, 1:17pm UTC](https://discuss.kubernetes.io/t/new-open-source-login-portal-for-kubernetes/3292 "2018-10-29T13:17:32Z")
Tremolo Security has “pre” launched a new login portal for Kubernetes using Active Directory - https://github.com/OpenUnison/openunison-k8s-login-activedirectory. This portal lets users login to both the dashboard and k… --- ## [Kubernetes and OIDC](https://discuss.kubernetes.io/t/kubernetes-and-oidc/978)
**Author:** [@mrbobbytables](https://discuss.kubernetes.io/u/mrbobbytables)\ **Replies:** 2\ **Last updated:** [June 27, 2018, 8:51am UTC](https://discuss.kubernetes.io/t/kubernetes-and-oidc/978 "2018-06-27T08:51:26Z")
OIDC has been a bit of a topic lately and I figured it’d be worth it to start a discussion on the subject. :slight\_smile: It was featured on this week’s TGIK – Going over OIDC/OAuth2 in general along with hooking Kubern…