A ClusterRoleBinding grants the permissions defined by a ClusterRole to users or services across the Kubernetes cluster. Unlike a RoleBinding, it operates at cluster scope; a role definition alone does not assign permissions. section 3.2.6
Use the binding model to separate permission definition from permission assignment:
- Define allowed resource permissions in a ClusterRole. section 3.2.6
- Create a ClusterRoleBinding to grant those permissions cluster-wide. section 3.2.6
- Use a RoleBinding when the same role must apply only within a namespace. section 3.2.6
Table 3.7 Binding types and their scopes (view table figure)
| Can be used to assign permissions only in the namespace in which it was created |
||
Compare RoleBinding and ClusterRoleBinding by scope and permission reach. section 3.2.6
