Role-based access control (RBAC) authorizes access to Kubernetes objects through permissions associated with users or groups. In a shared cluster, it helps separate tenants’ access alongside resource quotas and network policies. section 13.3.1 section 3.2.6
Choose the scope of both the permissions and their assignment:
- A Role holds permissions for its namespace; a ClusterRole holds permissions usable cluster-wide. section 3.2.6
- A RoleBinding assigns permissions within its namespace; a ClusterRoleBinding assigns them cluster-wide. section 3.2.6
Access through Anthos Connect
A request from the Google Cloud UI travels through Connect using the user’s or service’s credentials, so existing cluster RBAC rules still apply. The requester must also have permission to view the Google Cloud project attached to the cluster. Cluster access alone therefore does not grant remote access through Connect. section 2.3.2
Table 3.6 Roles used in Kubernetes (view table figure)
| Permissions in a Role can be used only in the namespace in which it was created. |
||
Compare the namespace and cluster scopes of Kubernetes roles. section 3.2.6
Table 3.7 Binding types and their scopes (view table figure)
| Can be used to assign permissions only in the namespace in which it was created |
||
Compare where each binding type can assign permissions. section 3.2.6
