RoleBinding
- Docker & Kubernetes course
- Advanced
- Lesson 45/70
- 4 min
Learn to bind a Role with a RoleBinding.
RoleBinding
A RoleBinding binds a role to one or more subjects. The subject kinds are User, Group and ServiceAccount. roleRef can't be changed later:
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ayse-pod-okuyucu
namespace: dev
subjects:
- kind: User
name: ayse
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-okuyucu
apiGroup: rbac.authorization.k8s.io
Binding by command
Bindings are also created with commands. A ClusterRoleBinding applies cluster-wide and is granted carefully:
kubectl create rolebinding ayse-view --clusterrole=view --user=ayse -n dev
kubectl create rolebinding ekip-edit --clusterrole=edit --group=gelistiriciler -n dev
kubectl create clusterrolebinding izleme-okuma --clusterrole=view --serviceaccount=izleme:prometheus
kubectl get rolebindings -n devPractice Create bindings
Write three commands: create a RoleBinding ayse-view in dev giving the user ayse the view ClusterRole; create a RoleBinding ekip-edit in dev giving the gelistiriciler group edit; list the RoleBindings in dev.
Starter code
# buraya yazSample solution
kubectl create rolebinding ayse-view --clusterrole=view --user=ayse -n dev
kubectl create rolebinding ekip-edit --clusterrole=edit --group=gelistiriciler -n dev
kubectl get rolebindings -n devExpected output
rolebinding.rbac.authorization.k8s.io/ayse-view created rolebinding.rbac.authorization.k8s.io/ekip-edit created NAME ROLE AGE ayse-view ClusterRole/view 5s ekip-edit ClusterRole/edit 3s
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 If a RoleBinding refers to a ClusterRole, where do the permissions apply?
- Across the whole cluster
- Nowhere
- In kube-system
- Only in the RoleBinding's namespace Correct answer
Explanation: This is the common way to grant the built-in view/edit roles in a single namespace.
2 Write the field naming the bound role.
Question
subjects:
- kind: User
name: ayse
____:
kind: Role
name: pod-okuyucu
Answer
subjects:
- kind: User
name: ayse
roleRef:
kind: Role
name: pod-okuyucuExplanation: roleRef is which role the binding grants.
3 Match.
| Term | Meaning |
|---|---|
subjects |
To whom |
roleRef |
Which role |
RoleBinding + ClusterRole |
In one namespace |
ClusterRoleBinding |
Whole cluster |