RBAC

RBAC — Role-Based Access Control

RBAC controls who can do what in your Kubernetes cluster. It lets you define roles with specific permissions and bind them to users, groups, or service accounts.

RBAC is essential for multi-tenant clusters where different teams need different levels of access.

RBAC Components

  ┌──────────────────────────────────────────────┐
  │              RBAC Model                      │
  │                                              │
  │  Subject ──▶ Role ──▶ Resources ──▶ Verbs   │
  │  (who)      (what     (which           (what │
  │            perms)     objects)         action)│
  └──────────────────────────────────────────────┘

  Subjects:          Roles:              Verbs:
  ├ User             ├ Role (namespace)  ├ get
  ├ Group            └ ClusterRole       ├ list
  └ ServiceAccount                       ├ create
                                         ├ update
  RoleBinding:                           ├ delete
  ├ RoleBinding (namespace)              └ watch
  └ ClusterRoleBinding (cluster-wide)

Creating Roles

# Role — permissions within a namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list"]

# ClusterRole — permissions across the entire cluster
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-viewer
rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get", "list", "watch"]

Binding Roles to Subjects

# RoleBinding — grant a Role to a subject in a namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
  - kind: User
    name: jane
    apiGroup: rbac.authorization.k8s.io
  - kind: ServiceAccount
    name: my-app-sa
    namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

# ClusterRoleBinding — grant a ClusterRole cluster-wide
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: global-node-viewer
subjects:
  - kind: Group
    name: devops-team
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: node-viewer
  apiGroup: rbac.authorization.k8s.io

Checking Access

# Check if a user can perform an action
kubectl auth can-i create pods --as jane
kubectl auth can-i delete nodes --as jane

# List all permissions for a user
kubectl auth can-i --list --as jane

# Check what a service account can do
kubectl auth can-i --list --as system:serviceaccount:default:my-app-sa

RBAC Best Practices

Least privilege — Grant only the permissions needed. Start restrictive, then add access as required.

Use groups — Bind roles to groups rather than individual users for easier management.

Avoid cluster-admin — Never give cluster-admin access to regular users or service accounts.

Audit regularly — Use kubectl auth can-i --list to review who has what access.