RBAC & Security Basics

Let's think about it this way for a second

A cluster admin can run 'anything' with Kubernetes commands, but giving every team admin access is dangerous (like accidentally deleting a production deployment). RBAC has 4 core concepts — Role (a set of permissions within one namespace, like 'can view pods'), ClusterRole (cluster-level permissions), RoleBinding (attaching a Role to a user/group), and ClusterRoleBinding (attaching a ClusterRole). Service Accounts matter here too — when an app inside a Pod itself needs to call the Kubernetes API (like a CI/CD tool), it needs to be given scoped permissions through a Service Account.

Let's connect this to a real scenario

If you create a `pod-reader` Role (with only get, list, watch permissions) for a developer team and connect team members to it with a RoleBinding, they can view pods but can't create or delete them. A CI/CD pipeline (like GitHub Actions) should only be given deployment-update permission, not cluster-wide admin permission.

Role/ClusterRole = a set of permissions (namespace-level / cluster-level)
RoleBinding/ClusterRoleBinding = attaching permissions to a user/group
Service Account = an identity for a Pod/app to call the K8s API itself

Let's look at it together

yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: staging
  name: pod-reader
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: staging
subjects:
  - kind: User
    name: dev-team
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

You should see

$ kubectl auth can-i delete pods --as=dev-team -n staging
no

$ kubectl auth can-i get pods --as=dev-team -n staging
yes

5-Minute Try-It

Apply a `pod-reader` Role and RoleBinding, then confirm the permissions with the `kubectl auth can-i` command.

A Quick Word of Caution

Don't put off setting up RBAC on a production cluster as something for 'later' — if every developer/CI tool starts out with default admin access, tightening it later gets a lot harder.