RBAC (Role-Based Access Control) controls who can do what in your Kubernetes cluster. Without it, anyone with cluster access can delete production workloads.
Core Concepts
| Resource | Scope | Purpose |
|---|---|---|
| Role | Namespace | Permissions within one namespace |
| ClusterRole | Cluster-wide | Permissions across all namespaces |
| RoleBinding | Namespace | Assigns a Role/ClusterRole to users in a namespace |
| ClusterRoleBinding | Cluster-wide | Assigns a ClusterRole to users cluster-wide |
| ServiceAccount | Namespace | Identity for pods/processes |
Roles and Permissions
Namespace Role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: developer
namespace: staging
rules:
- apiGroups: [""]
resources: ["pods", "services", "configmaps"]
verbs: ["get", "list", "watch", "create", "update", "delete"]
- apiGroups: ["apps"]
resources: ["deployments", "replicasets"]
verbs: ["get", "list", "watch", "create", "update"]
- apiGroups: [""]
resources: ["pods/log", "pods/exec"]
verbs: ["get", "create"]ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: readonly
rules:
- apiGroups: [""]
resources: ["*"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
resources: ["*"]
verbs: ["get", "list", "watch"]Master this topic with hands-on labs
Go beyond reading — build real projects in sandboxed environments with expert video guidance.
Browse Courses →Bindings
RoleBinding (Namespace-Scoped)
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: developer-binding
namespace: staging
subjects:
- kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
- kind: Group
name: developers
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: developer
apiGroup: rbac.authorization.k8s.ioClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: readonly-binding
subjects:
- kind: Group
name: auditors
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: readonly
apiGroup: rbac.authorization.k8s.ioService Accounts for Applications
apiVersion: v1
kind: ServiceAccount
metadata:
name: app-sa
namespace: production
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: app-role
namespace: production
rules:
- apiGroups: [""]
resources: ["secrets"]
resourceNames: ["app-secrets"] # Only specific secret
verbs: ["get"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: app-binding
namespace: production
subjects:
- kind: ServiceAccount
name: app-sa
namespace: production
roleRef:
kind: Role
name: app-role
apiGroup: rbac.authorization.k8s.ioUse in a deployment:
spec:
serviceAccountName: app-sa
automountServiceAccountToken: true # Only if app needs K8s API access
containers:
- name: app
image: my-appCommon Patterns
Developer Access (Namespace Only)
# Can manage workloads in their namespace
# Cannot access secrets or other namespaces
rules:
- apiGroups: ["", "apps"]
resources: ["pods", "deployments", "services", "configmaps"]
verbs: ["*"]
- apiGroups: [""]
resources: ["pods/log", "pods/exec", "pods/portforward"]
verbs: ["get", "create"]CI/CD Pipeline Access
# Can deploy but not delete namespaces or access secrets directly
rules:
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "patch", "update"]
- apiGroups: [""]
resources: ["services", "configmaps"]
verbs: ["get", "list", "create", "update"]Read-Only Monitoring
rules:
- apiGroups: [""]
resources: ["pods", "services", "nodes", "namespaces"]
verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
resources: ["pods", "nodes"]
verbs: ["get", "list"]Get weekly IT automation tips
Docker, Ansible, Terraform, MLOps — curated insights delivered to your inbox. No spam.
Subscribe Free →Debugging RBAC
# Check if you can do something
kubectl auth can-i create deployments --namespace staging
kubectl auth can-i delete pods --namespace production
# Check what a user can do
kubectl auth can-i --list --as alice --namespace staging
# Check service account permissions
kubectl auth can-i get secrets --as system:serviceaccount:production:app-sa
# View all role bindings in a namespace
kubectl get rolebindings -n staging -o wide
kubectl get clusterrolebindings -o wide | grep aliceBest Practices
| Practice | Why |
|---|---|
| Namespace isolation | Each team gets their own namespace |
| Least privilege | Start with nothing, add what's needed |
| No cluster-admin for developers | Use namespace-scoped roles |
| Service accounts per app | Don't share the default SA |
| Disable SA token auto-mount | automountServiceAccountToken: false unless needed |
| Audit RBAC regularly | kubectl auth can-i --list for each role |
| Use groups over individual users | Easier to manage at scale |
What's Next?
Our MLflow for Kubernetes MLOps course covers Kubernetes RBAC for ML workloads and service accounts for model serving. First lesson is free. -e ---
Ready to go deeper? Explore our hands-on DevOps courses — from Docker and Terraform to MLflow on Kubernetes.
Ready to learn by doing?
Stop reading tutorials — start building. Expert video courses with hands-on labs in real sandboxed environments.
Related Articles
Kubernetes Namespaces Multi-Tenancy
Kubernetes multi-tenancy with namespaces. Resource quotas, limit ranges, network policies, and RBAC for isolating teams.
Kubernetes Pod Security Standards
Kubernetes Pod Security Standards for workload hardening. Privileged, Baseline, and Restricted profiles with YAML and migration tips.
Kubernetes Network Policies Guide
Secure Kubernetes clusters with network policies. Default deny rules, namespace isolation, pod-level controls, and CNI compatibility.
Kubernetes Resource Requests Limits
Set Kubernetes CPU and memory requests and limits correctly. QoS classes, OOMKilled troubleshooting, and VPA right-sizing.
Kubernetes Service Types Explained
Kubernetes service types explained. ClusterIP, NodePort, LoadBalancer, ExternalName, and headless services with YAML examples.
Kubernetes Services and Ingress
Expose Kubernetes workloads with ClusterIP, NodePort, LoadBalancer services and Ingress controllers. Practical examples.
Explore topics
Browse more articles on the topics covered here.