A Role defines which actions are permitted on specified Kubernetes resources within one namespace. Its rules name resources, such as pods, and API verbs, such as get, list, watch, create, and delete. A Role does not grant access by itself: a RoleBinding connects it to a user, group, or ServiceAccount. Authentication identifies the requester; RBAC then determines whether the requested action is authorized. section 3.1.1 section 3.1 section 3.3
To give someone limited access to pods:
- Create the Role: `kubectl create role pod-reader --verb=get,list,watch --resource=pods`. Inspect its resources and verbs with `kubectl get role pod-reader -o yaml`. section 3.1.1
- Bind it to a user: `kubectl create rolebinding pod-reader-binding --role=pod-reader --user=carol`. Inspect the binding with `kubectl get rolebinding pod-reader-binding -o yaml`. section 3.1.1
- Test the boundary: `kubectl auth can-i get pods -n default --as carol` returns `yes`, while `kubectl auth can-i delete pods -n default --as carol` returns `no`. section 3.1.1
Use a Role for namespace-scoped permissions; use a ClusterRole when permissions must cover cluster-scoped resources such as nodes or persistent volumes. A ClusterRoleBinding cannot refer to a Role. For a declarative workflow, generate Role YAML with a dry run, save it to a file, and review the rules before applying it. section 3.1.1 section 3.4
Grant pod-list access to a ServiceAccount
Create a Role with `kubectl create role pod-list --verb=list --resource=pods`, then bind it with `kubectl create rolebinding pod-list-bind --role=pod-list --serviceaccount=default:nomount-sa`. Verify with `kubectl auth can-i list pods --as system:serviceaccount:default:nomount-sa`; the example returns `yes`. A ServiceAccount token authenticates the pod, while the Role and binding limit what it may do. section 3.3
$ kubectl create rolebinding pod-reader-binding --role=pod-reader --user=carol rolebinding.rbac.authorization.k8s.io/pod-reader-binding created $ kubectl get rolebinding pod-reader-binding -oyaml apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: creationTimestamp: "2022-03-29T04:22:35Z" name: pod-reader-binding namespace: default resourceVersion: "566785" uid: 9f7d1036-9123-4288-94cf-ef527aa090d0 roleRef: apiGroup: rbac.authorization.k8s.io kind: Role name: pod-reader subjects: - apiGroup: rbac.authorization.k8s.io kind: User name: carol
Inspect the RoleBinding YAML to see how `roleRef` names the Role and `subjects` names the user receiving its permissions. section 3.1.1
