What is RBAC?

Learn the Role-Based Access Control concept.

What is RBAC?

RBAC (Role-Based Access Control) determines who (user, group, ServiceAccount) can perform which operations on which resources in the Kubernetes API. By default everything is denied; permissions are granted explicitly. There are four objects:

Role / ClusterRole: a set of permissions (what can be done).
RoleBinding / ClusterRoleBinding: binds the permission to a subject (who can do it).

$ kubectl auth can-i delete pods -n prod --as ayse
no
$ kubectl auth can-i list pods -n dev --as ayse
yes

auth can-i

kubectl auth can-i asks whether an operation can be done. --as lets you ask on behalf of another user or ServiceAccount (this also requires permission); --list lists all permissions:

kubectl auth can-i create deployments -n dev
kubectl auth can-i get secrets --as system:serviceaccount:dev:api -n dev
kubectl auth can-i --list -n dev --as ayse

Exercise Query permissions

Write three commands: can you create deployments in the dev namespace; can ayse delete pods in prod; list all of ayse's permissions in dev.

Show example solution

kubectl auth can-i create deployments -n dev
kubectl auth can-i delete pods -n prod --as ayse
kubectl auth can-i --list -n dev --as ayse

Test yourself

In RBAC, what is the default outcome for an operation without a permission?
- The admin is asked
- It's denied; RBAC only adds permissions, there are no deny rules
- It's allowed
- It's allowed with a warning
Show answer

It's denied; RBAC only adds permissions, there are no deny rules — RBAC is additive: the union of permissions applies.

Ask about a permission on behalf of another user.

kubectl auth can-i delete pods -n prod ____ ayse

Show answer

kubectl auth can-i delete pods -n prod --as ayse

Match.

Role

What can be done
RoleBinding

Who can do it
auth can-i

Permission query
default

Deny

Next lesson: Role and ClusterRole

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies