Cloud Intermediate
Kubernetes RBAC¶
KubernetesRBACSecurity 3 min read
Role-Based Access Control in Kubernetes. Roles, ClusterRoles, bindings and service accounts.
Concept¶
RBAC controls who (Subject) can do what (Verb) with which resource (Resource). Roles for namespaces, ClusterRoles for the entire cluster.
Example¶
# Role — read-only access to pods
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: production
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "watch"]
---
# Binding
kind: RoleBinding
metadata:
namespace: production
name: read-pods
subjects:
- kind: User
name: [email protected]
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Best Practices¶
- Principle of least privilege
- Namespace-scoped Roles where possible
- Service Account per application
- Regular RBAC audit
Summary¶
RBAC is the foundation of K8s security. Always configure it — the default service account has too many permissions.
Need Help with Implementation?¶
Our team has experience designing and implementing modern architectures. We’re happy to help.