Role and ClusterRole
- Docker & Kubernetes course
- Advanced
- Lesson 44/70
- 4 min
Learn the differences between Role and ClusterRole.
Role and ClusterRole
A Role is specific to a namespace; a ClusterRole is cluster-scoped: it can apply in all namespaces or to cluster-scoped resources like nodes and PVs. Each rule contains apiGroups, resources and verbs:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-okuyucu
namespace: dev
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
"" is the core API group (pods, services, configmaps); deployments are in the "apps" group.
Built-in ClusterRoles
Kubernetes ships ready-to-use ClusterRoles: view (read, except Secrets), edit (modify most resources, except RBAC), admin (everything within a namespace), cluster-admin (everything). These are considered before writing your own role:
$ kubectl get clusterroles view edit admin cluster-admin
kubectl describe clusterrole view | head -12
kubectl create role deploy-yonetici --verb=get,list,create,update,patch --resource=deployments -n devPractice A pod reader role
Write a Role YAML: rbac.authorization.k8s.io/v1; name pod-okuyucu, namespace dev; a single rule: apiGroups: [""], resources: ["pods", "pods/log"], verbs: ["get", "list", "watch"].
Starter code
# buraya yazSample solution
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-okuyucu
namespace: dev
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]Expected output
role.rbac.authorization.k8s.io/pod-okuyucu created
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Can permission to list nodes be given with a Role?
- No; nodes are cluster-scoped, a ClusterRole is needed Correct answer
- Yes
- Only in the default namespace
- Only for reading
Explanation: A Role only covers resources in its own namespace.
2 Specify the core API group.
rules:
- apiGroups: [____]
resources: ["pods"]rules:
- apiGroups: [""]
resources: ["pods"]Explanation: The core group is the empty string.
3 Match.
| Term | Meaning |
|---|---|
view |
Read (no Secrets) |
edit |
Modify |
admin |
Namespace admin |
cluster-admin |
Everything |