Summary - RBAC

Combine Role, Binding and ServiceAccount to write permissions.

Summary: RBAC

In this group:

RBAC denies everything by default; permissions are additive.
Role (namespace) and ClusterRole (cluster) are permission sets: apiGroups, resources, verbs, optional resourceNames.
RoleBinding and ClusterRoleBinding bind a role to a subject (User, Group, ServiceAccount); RoleBinding + ClusterRole applies in one namespace.
A ServiceAccount is a pod identity; an app-specific SA with least privilege is given, and the token isn't mounted if not needed.
Subresources (pods/log, pods/exec) need separate permissions; "*" is avoided. auth can-i tests.

kubectl auth can-i --list --as system:serviceaccount:dev:api -n dev

Exercise Write the binding in YAML

Write a RoleBinding YAML: name ayse-pod-okuyucu, namespace dev; subject kind: User, name: ayse, apiGroup: rbac.authorization.k8s.io; roleRef kind: Role, name: pod-okuyucu, apiGroup: rbac.authorization.k8s.io.

Show example solution

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ayse-pod-okuyucu
  namespace: dev
subjects:
  - kind: User
    name: ayse
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-okuyucu
  apiGroup: rbac.authorization.k8s.io

Test yourself

What is the shortest way to give a developer permission to modify most resources only in the dev namespace?
- A RoleBinding in dev granting the edit ClusterRole
- A cluster-admin ClusterRoleBinding
- A separate Role for each resource
- Sharing the default ServiceAccount
Show answer

A RoleBinding in dev granting the edit ClusterRole — Binding the built-in role to the namespace is enough.

Turn off mounting the token into the pod.

    spec:
      ____: false

Show answer

    spec:
      automountServiceAccountToken: false

Match.

Role

Namespace permissions
ClusterRole

Cluster permissions
RoleBinding

Namespace binding
ServiceAccount

Pod identity

Next lesson: What is Prometheus?

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies