Kubernetes RBAC

Kubernetes RBAC — roles, bindings, service accounts, and permission verification.

Inspect Existing RBAC

List roles and bindings
kubectl get roles -A
kubectl get rolebindings -A
kubectl get clusterroles | head -20
kubectl get clusterrolebindings | head -20
Describe a role to see its permissions
kubectl describe role pod-reader -n default
kubectl describe clusterrole admin
kubectl describe clusterrolebinding cluster-admin

Check Permissions

Test what a user or service account can do
kubectl auth can-i create pods                     # current user
kubectl auth can-i create pods --as=system:serviceaccount:default:myapp
kubectl auth can-i '*' '*'                         # am I cluster-admin?
kubectl auth can-i list secrets -n monitoring --as=jane
List all permissions for a service account
kubectl auth can-i --list --as=system:serviceaccount:default:myapp

Create Roles

Namespace-scoped Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
Cluster-wide ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]

Create Bindings

Bind a Role to a ServiceAccount
kubectl create rolebinding myapp-pod-reader \
  --role=pod-reader \
  --serviceaccount=default:myapp \
  -n default
Bind a ClusterRole across the cluster
kubectl create clusterrolebinding monitoring-reader \
  --clusterrole=view \
  --serviceaccount=monitoring:prometheus

Service Accounts

Create and use service accounts
kubectl create serviceaccount myapp -n default
kubectl get serviceaccount -n default
Get the token for a service account (Kubernetes 1.24+)
kubectl create token myapp -n default              # short-lived token
kubectl create token myapp -n default --duration=24h

Aggregated ClusterRoles

Built-in aggregation labels
# admin, edit, view are aggregated ClusterRoles
# Adding label rbac.authorization.k8s.io/aggregate-to-view: "true"
# to your ClusterRole automatically merges it into "view"
kubectl get clusterrole view -o yaml | grep -A5 aggregationRule

Troubleshooting

Debug access denied errors
# Check the error message for the missing permission
# Error: pods is forbidden: User "system:serviceaccount:default:myapp"
#   cannot list resource "pods" in API group "" in the namespace "monitoring"

# Verify bindings exist
kubectl get rolebindings,clusterrolebindings -A | grep myapp

See Also