How deeply does Google Anthos in Action cover role?

Defines Role scope and distinguishes permission sets from bindings, without providing a Role manifest or creation command.

Role

As explained in Google Anthos in Action

A Kubernetes Role is a namespace-scoped RBAC resource that defines permissions on resources.

A Kubernetes Role defines permissions on one or more resources within a namespace. It must be created in a namespace, and its permissions can be assigned only there. Use a Role when access should not extend to other namespaces in a shared cluster. section 3.2.6

A Role defines the permission set; a binding assigns permissions to a user or service. A RoleBinding is namespace-scoped. By contrast, a ClusterRole can be used cluster-wide or assigned within a namespace, while a ClusterRoleBinding assigns permissions cluster-wide. Check both the permission resource and the binding before granting access. section 3.2.6

Console access to an attached cluster

Token login to an attached cluster requires a Kubernetes Service Account with suitable RBAC permissions. The example binds the account to `view` and `cloud-console-reader` using ClusterRoleBindings—not to a namespace-scoped Role. The former provides read-only access to most objects in a namespace but excludes roles and role bindings; the latter permits viewing nodes, persistent volumes, and storage classes in the console. section 2.7

Table 3.6 Roles used in Kubernetes (view table figure)

Role type	Scope	Description
Role	Namespace	Permissions in a Role can be used only in the namespace in which it was created.
ClusterRole	Cluster	Permissions in a ClusterRole can be used cluster wide.

Compare where Role and ClusterRole permissions can be used. section 3.2.6

How Google Anthos in Action covers it

liveBook manning.com

Read Google Anthos in Action on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Acing the Certified Kubernetes Administrator Exam, Second EditionA role is a Kubernetes RBAC object that defines permitted actions on specified resources within a namespace.

Compare how 2 books explain role →

Related concepts

RoleBindingused by · A RoleBinding is a Kubernetes RBAC resource that grants a Role or ClusterRole's permissions to specified users, groups, or service accounts within a namespace.
role-based access controlused by · Role-based access control is an authorization model that assigns permissions to roles and grants users or other principals access through their assigned roles.
Anthos Config Managementconfigured by · Anthos Config Management is a Google Anthos component for centrally applying policy and configuration to clusters and services.
Kubernetesconfigured by · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.
IAM roleequivalent to · An IAM role is an identity configuration containing permissions that a trusted user, service, account, or other principal can assume, typically without long-term credentials.
rolekind of · A role is a defined function, responsibility, perspective, or set of permissions associated with a participant in an organization or system.

This explainer was generated by Manning's knowledge graph from the text of Google Anthos in Action. The section links point to the parts of the book it draws on.