Group authentication in kubernetes
This is something I have implemented recently.
NOTE: I'm assuming you are aware ho to add users. or users in group in this case.
here is what I have applied:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly_role
rules: 
- apiGroups:
  - &quot;&quot;
  resourceNames:
  - &quot;&quot;
  resources:
  - &quot;pods&quot;
  - &quot;pods/logs&quot;
  - &quot;deployments&quot;
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - authorization.k8s.io
  resources:
  - selfsubjectaccessreviews
  - selfsubjectrulesreviews
  verbs:
  - watch
  - get
  - list

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: bind_readonly_dev_role
subjects:
- kind: Group
  name: myorg:readonly 
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: readonly_role
  apiGroup: rbac.authorization.k8s.io


You can use either ClusterRole &amp; ClusterRoleBinding or else just Role &amp; Rolebinding, depending on your requirement. In case you are not looking for cluster scoped access, instead just a namespace, I would strongly suggest going with the Role &amp; Rolebinding kind of object.
What I'm doing/creating in the above?
I'm creating one RBAC Role (readonly_role) scoped to Cluster.
and in that I'm specifying I want to let access pods, logs (i.e pods/logs), and deployments. additionally you. can also add things like services or else if you just want to give access to all specify &quot;&quot; instead.
in the 2nd part, I'm creating a ClusterRoleBinding Object named bind_readonly_dev_role  which ensures only users in group myorg:readonly are having this role or privileges in the role we just created (readonly_role ).
NOTE: Incase you want to allow proxy access to certain applications, like kubectl proxy.
you might have to specify them separately in the ClusterRole rules.
I do like this for one of my svc:
- apiGroups:
  - &quot;&quot;
  resourceNames:
  - dashboard:5000
  resources:
  - services/proxy
  verbs:
  - '*'


at last but not least, you have to test if the user has those privileges correct,
you can test like this:
kubectl auth  can-i get pods --as myorg:readonly

in the above replace the pods with the object you want the users of the group to have access to.
Hope this helps!