Skip to main content
Mapagam

Configuring RBAC Authorization

1. Creating ServiceAccount

Property Value Description
apiVersion v1 API version of the ServiceAccount resource
kind ServiceAccount Type of the Kubernetes resource
metadata.name my-service-account Name of the ServiceAccount to be created
metadata.namespace default Namespace where the ServiceAccount will be created

Example: Create a ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: default
Note: ServiceAccounts are used by pods to communicate with the Kubernetes API server. They can be associated with roles or cluster roles via RoleBindings or ClusterRoleBindings.

2. Creating Role

Property Description Example
apiVersion API version of the Role resource v1
kind Kind of the resource (must be Role) Role
metadata.name Name of the Role pod-reader
rules List of rules defining permissions [{apiGroups: [""], resources: ["pods"], verbs: ["get", "watch", "list"]}]

Example: Define a Role to Read Pods

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

3. Creating ClusterRole

Property Description Example
apiVersion API version of the resource v1
kind Type of the Kubernetes resource ClusterRole
metadata.name Name of the ClusterRole admin-cluster-role
rules List of policy rules to define permissions 
[
  {
    "apiGroups": [""],
    "resources": ["pods"],
    "verbs": ["get", "list", "watch"]
  }
]

Example: Define a ClusterRole with Pod Access

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

4. Creating RoleBinding

Property Description Example
kind Kind of the object. Must be RoleBinding. RoleBinding
metadata.name Name of the RoleBinding. read-pods-binding
metadata.namespace Namespace where the RoleBinding is created. default
roleRef.kind Kind of the role to bind. Can be Role or ClusterRole. Role
roleRef.name Name of the role to bind. pod-reader
subjects List of subjects to bind the role to. [{kind: User, name: alice, apiGroup: rbac.authorization.k8s.io}]

Example: Creating a RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
subjects:
- kind: User
  name: alice
  apiGroup: rbac.authorization.k8s.io

5. Creating ClusterRoleBinding

Field Description Example Value
apiVersion API version of the resource v1
kind Kind of the resource ClusterRoleBinding
metadata.name Name of the ClusterRoleBinding admin-cluster-role-binding
subjects List of subjects to bind to the role 
[
  {
    "kind": "User",
    "name": "john-doe",
    "apiGroup": "rbac.authorization.k8s.io"
  }
]
roleRef Reference to the ClusterRole to bind 
{
  "kind": "ClusterRole",
  "name": "cluster-admin",
  "apiGroup": "rbac.authorization.k8s.io"
}

Example: Creating a ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-cluster-role-binding
subjects:
- kind: User
  name: john-doe
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
Note: The subjects field can include Users, Groups, or ServiceAccounts.

6. Viewing Permissions

Permission Resource Actions Notes
get namespaces get View namespace details
list namespaces list List all namespaces
get deployments get View deployment details
list deployments list List deployments in a namespace
get pods get View pod details
list pods list List pods in a namespace

Example: Check permissions for a user

kubectl auth can-i get pods --as=system:serviceaccount:default:my-user
Note: Use kubectl auth can-i to check if a user or service account has specific permissions.

7. Testing User Permissions

Example: Check Permission for Pod List

kubectl auth can-i --list --as=system:serviceaccount:default:myuser
Resource Verb Notes
pods list Allows listing pods in a namespace
pods get Allows getting details of a specific pod
Note: Use kubectl auth can-i to test permissions for a user or service account.

Example: Simulate User Access

kubectl auth can-i get pods --as=system:serviceaccount:default:myuser

8. Using Default ClusterRoles

ClusterRole Description Permissions Notes
cluster-admin Full access to all resources in the cluster All permissions across all resources Highly privileged role, should be used sparingly
cluster-reader Read-only access to all resources in the cluster Read access to all resources Useful for monitoring and auditing purposes
admin Full access to all resources in a namespace All permissions within a namespace Can manage all resources in a namespace but not cluster-wide resources
edit Full access to all resources in a namespace except roles and role bindings All permissions within a namespace except roles and role bindings Useful for developers who need to manage resources but not RBAC settings
view Read-only access to all resources in a namespace except roles and role bindings Read access within a namespace except roles and role bindings Useful for users who need to observe resources but not make changes

Example: Assigning ClusterRole to a User

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: admin-user-binding
subjects:
- kind: User
  name: admin-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

9. Configuring API Groups

API Group Description Resources Permissions
core Core Kubernetes API group containing fundamental resources Pods, Services, Nodes, Namespaces get, list, watch, create, update, delete
apps API group for managing applications and their deployments Deployments, StatefulSets, DaemonSets get, list, watch, create, update, delete
batch API group for managing batch jobs and cron jobs CronJobs, Jobs get, list, watch, create, update, delete
networking.k8s.io Networking resources for services and ingress Ingress, NetworkPolicies get, list, watch, create, update, delete
rbac.authorization.k8s.io RBAC resources for managing roles and permissions Role, ClusterRole, RoleBinding, ClusterRoleBinding get, list, watch, create, update, delete

Example: Define a Role with API Group Permissions

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: ["core"]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

10. Setting Resource Names

Resource Type Resource Name Format Notes
Role namespace/name Must be in the format namespace/name where name is the name of the role within the namespace.
ClusterRole name Must be a unique name within the cluster scope.
RoleBinding namespace/name Must be in the format namespace/name where name is the name of the role binding within the namespace.
ClusterRoleBinding name Must be a unique name within the cluster scope.

Example: Defining a Role with Resource Names

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Example: Binding a Role to a User

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

11. Understanding Verbs

Verb Description Examples
get Retrieve a resource kubectl get pods
list List resources in a namespace kubectl get pods --list
watch Watch resources for changes kubectl get pods --watch
create Create a new resource kubectl create deployment nginx --image=nginx
update Update an existing resource kubectl patch deployment nginx -p '{"spec":{"replicas":3}}
patch Partially update a resource kubectl patch deployment nginx -p '{"spec":{"replicas":3}}
delete Delete a resource kubectl delete deployment nginx
deletecollection Delete a collection of resources kubectl delete pods --all
exec Execute commands in a container kubectl exec -it pod-name -- /bin/sh
portforward Forward local ports to a pod kubectl port-forward pod-name 8080:80
proxy Start a proxy server to Kubernetes API kubectl proxy --port=8080
logs Retrieve logs from a pod kubectl logs pod-name
attach Attach to a running container kubectl attach pod-name -c container-name
describe Get detailed information about a resource kubectl describe pod nginx-pod
scale Scale a resource (e.g., replicas) kubectl scale deployment nginx --replicas=5
edit Edit a resource in the default editor kubectl edit deployment nginx
auth Check authorization permissions kubectl auth can-i --list

12. Aggregating ClusterRoles

Property Description Example
aggregationRule Defines how ClusterRoles are aggregated. Used in ClusterRole definitions to group roles. 
{
  "aggregationRule": {
    "clusterRoleSelectors": [
      {
        "matchLabels": {
          "rbac.example.com/aggregate-to": "admin"
        }
      }
    ]
  }
}

Example: Aggregating ClusterRoles

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: admin-aggregated
  labels:
    rbac.example.com/aggregate-to: admin
rules:
- apiGroups: [""]
  resources: ["users", "groups"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: admin-clusterrole
  labels:
    rbac.example.com/aggregate-to: admin
rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  verbs: ["get", "list"]
Note: Aggregated ClusterRoles are useful for organizing permissions across large clusters by grouping related roles under a single logical role.

Was this article helpful?

Related Cheat Sheets