Docker Desktop Kubernetes NOT enforcing RBAC rules

by Neil Cresswell, on Oct 28, 2021 3:04:02 AM

So here is a little golden nugget of awesomeness that might just save you a TON of time (as it wasted hours of my time trying to triage why the RBAC rules Portainer was trying to set were being ignored)..

If you are using Docker Desktop, and their embedded Kubernetes offering, you may not be aware but, by default it does NOT enforce any RBAC rules. It will let you create RBAC rules, but it wont enforce them.

Why?

Because Docker made a design descision (in the name of simplicity) to make ALL service accounts automatically receive cluster-admin role BY DEFAULT.

The Role Binding they set is as below:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: docker-for-desktop-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts
If you want to reverse this design decision, you simply need to run "kubectl delete clusterrolebinding docker-for-desktop-binding" and then like magic (and like every other Kubernetes distro out there!!), it will start enforcing RBAC rules.

Docker actually state that they "fixed" this in Aug 2019, and their technical fix was to add: namespace: kube-system to the end of the "subjects" line, but that didnt actually resolve the issue (hence why i still ran into this issue today).

Repeated calls from Docker Desktop users to have Docker resolve this have seeingly fallen onto deaf ears (see issue 4774 referenced below)..

If you want to fix this yourself, first delete the clusterrolebinding, and then add a new one (similar to Docker's, but actually correct):

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: docker-for-desktop-binding
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: Group
name: system:serviceaccounts:kube-system

We have subscribed to the open github issue on the docker desktop repo where people are asking for this to be resolved, and once we see it resolved, we will delete this post..

Hope this is helpful.

Neil

Links:
Original resported issue here (which was claimed as fixed): https://github.com/docker/for-mac/issues/3694

And the reopend issue that is seemingly going nowhere: https://github.com/docker/for-mac/issues/4774


 

 

 

 

See for yourself with a live online Portainer Business demo

Let us introduce you to a world of fast and easy app deployment, governance, and management in Docker/Swarm and Kubernetes. Schedule a demo with our tech team and see how Portainer's container service delivery platform can make everyone's life easier.

REQUEST A PORTAINER BUSINESS DEMO

Comments