Kubernetes Tutorial · Operating Kubernetes · Lesson 22 of 26

RBAC: Who Can Do What

Roles, ClusterRoles and bindings for people and service accounts, and how to check permissions.

Create a free account to save this page, take notes and track your progress. Sign in

The model

A Role (namespaced) or ClusterRole lists allowed verbs on resources (get, list, create...).
A RoleBinding or ClusterRoleBinding grants a role to users, groups or ServiceAccounts.
Pods run as a ServiceAccount; give each workload its own with only the permissions it needs, and set automountServiceAccountToken: false when it needs none.

kubectl auth can-i answers "may this identity do this?", which is invaluable for reviewing access.

A read-only service account

kubectl create namespace demo-rbac > /dev/null
trap 'kubectl delete namespace demo-rbac --wait=false > /dev/null' EXIT
kubectl -n demo-rbac create serviceaccount reporter > /dev/null
kubectl -n demo-rbac create role pod-reader --verb=get,list,watch --resource=pods > /dev/null
kubectl -n demo-rbac create rolebinding reporter-reads-pods --role=pod-reader --serviceaccount=demo-rbac:reporter > /dev/null
as="--as=system:serviceaccount:demo-rbac:reporter"
for check in "list pods" "delete pods" "get secrets" "list pods -n default"; do
  printf '%-24s %s\n' "can-i $check:" "$(kubectl -n demo-rbac auth can-i $check $as 2>/dev/null)"
done

Output

can-i list pods:         yes
can-i delete pods:       no
can-i get secrets:       no
can-i list pods -n default: no

Run this on your computer — see “Get Started” for setup.

See Using RBAC Authorization.

Test yourself

A CI pipeline deploys to one namespace. What should its credentials allow?

cluster-admin, to be safe
Only the verbs and resources it needs in that namespace (a Role and RoleBinding)
Read access to all Secrets
Nothing; use the default account

Show answer

Answer: Only the verbs and resources it needs in that namespace (a Role and RoleBinding)

Least privilege limits damage if the pipeline is compromised.

Was this page helpful?