Role and ClusterRole

Learn the differences between Role and ClusterRole.

Role and ClusterRole

A Role is specific to a namespace; a ClusterRole is cluster-scoped: it can apply in all namespaces or to cluster-scoped resources like nodes and PVs. Each rule contains apiGroups, resources and verbs:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-okuyucu
  namespace: dev
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]

"" is the core API group (pods, services, configmaps); deployments are in the "apps" group.

Built-in ClusterRoles

Kubernetes ships ready-to-use ClusterRoles: view (read, except Secrets), edit (modify most resources, except RBAC), admin (everything within a namespace), cluster-admin (everything). These are considered before writing your own role:

$ kubectl get clusterroles view edit admin cluster-admin
kubectl describe clusterrole view | head -12
kubectl create role deploy-yonetici --verb=get,list,create,update,patch --resource=deployments -n dev

Exercise A pod reader role

Write a Role YAML: rbac.authorization.k8s.io/v1; name pod-okuyucu, namespace dev; a single rule: apiGroups: [""], resources: ["pods", "pods/log"], verbs: ["get", "list", "watch"].

Show example solution

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-okuyucu
  namespace: dev
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]

Test yourself

Can permission to list nodes be given with a Role?
- No; nodes are cluster-scoped, a ClusterRole is needed
- Yes
- Only in the default namespace
- Only for reading
Show answer

No; nodes are cluster-scoped, a ClusterRole is needed — A Role only covers resources in its own namespace.

Specify the core API group.

rules:
  - apiGroups: [____]
    resources: ["pods"]

Show answer

rules:
  - apiGroups: [""]
    resources: ["pods"]

Match.

view

Read (no Secrets)
edit

Modify
admin

Namespace admin
cluster-admin

Everything

Next lesson: RoleBinding

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies