RBAC in Kubernetes: Understanding Roles, and RoleBindings 🔐

[Sascha]

Kubernetes is a powerful platform for managing containerized applications, but with great power comes the need for granular access control.

Enter Role-Based Access Control (RBAC)—a security mechanism that allows you to define who can do what in your cluster. In this article, we’ll dive into Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings, explore their different combinations, and explain why ClusterRole with RoleBinding is possible but not the other way around.

� The Problem: Managing Access in Kubernetes


In a Kubernetes cluster, you might have:

• 
  Developers who need access to specific namespaces.
  
  
• 
  Admins who require cluster-wide privileges.
  
  
• 
  CI/CD tools that need limited permissions to deploy applications.
  

Without proper access control:

• 
  Users or services might have more permissions than they need, leading to security risks.
  
  
• 
  It’s difficult to enforce the principle of least privilege.
  
  
• 
  Auditing and compliance become challenging.
  

This is where RBAC comes into play.

What Are Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings?

1. Role: Namespace-Specific Permissions


A Role defines a set of permissions (e.g., get, list, create) for resources within a specific namespace.

Example Role:


apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: default
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch"]



2. RoleBinding: Granting Roles to Users or Groups


A RoleBinding binds a Role to a user, group, or service account within a specific namespace.

Example RoleBinding:


apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
namespace: default
name: pod-reader-binding
subjects:
- kind: User
name: alice
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io



3. ClusterRole: Cluster-Wide Permissions


A ClusterRole defines permissions for resources across the entire cluster (including non-namespaced resources like Nodes or PersistentVolumes).

Example ClusterRole:


apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cluster-admin
rules:
- apiGroups: [""]
resources: ["*"]
verbs: ["*"]



4. ClusterRoleBinding: Granting ClusterRoles to Users or Groups


A ClusterRoleBinding binds a ClusterRole to a user, group, or service account across the entire cluster.

Example ClusterRoleBinding:


apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cluster-admin-binding
subjects:
- kind: User
name: admin
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: ClusterRole
name: cluster-admin
apiGroup: rbac.authorization.k8s.io



Different Combinations of Roles and Bindings

Role Type	Binding Type	Scope	Use Case
Role	RoleBinding	Namespace-specific	Granting access to resources within a specific namespace (e.g., dev team).
ClusterRole	RoleBinding	Namespace-specific	Granting cluster-wide permissions but limiting them to a specific namespace.
ClusterRole	ClusterRoleBinding	Cluster-wide	Granting cluster-wide permissions (e.g., cluster admins).
Role	ClusterRoleBinding	Not Allowed	Roles are namespace-specific and cannot be bound cluster-wide.

Why ClusterRole with RoleBinding is Possible (But Not the Other Way Around)

1. ClusterRole with RoleBinding


A ClusterRole can be bound to a RoleBinding within a specific namespace. This allows you to:

• 
  Define cluster-wide permissions (e.g., for a set of resources).
  
  
• 
  Apply those permissions only to a specific namespace.
  

Example: A ClusterRole for managing Pods across the cluster can be bound to a RoleBinding in the default namespace, granting Pod management permissions only in that namespace.

2. Role with ClusterRoleBinding is Not Allowed


A Role is namespace-scoped, meaning it only applies to resources within a specific namespace. Binding it to a ClusterRoleBinding (which is cluster-wide) would create ambiguity:

• 
  Which namespace should the Role apply to?
  
  
• 
  How should the Role’s permissions be enforced across the cluster?
  

This is why Kubernetes does not allow this combination.

When to Use Each Combination

1. 
   Role + RoleBinding:
   
   Use for namespace-specific access (e.g., granting a developer access to the dev namespace).
   
   
2. 
   ClusterRole + RoleBinding:
   
   Use for namespace-specific access with cluster-wide permissions (e.g., granting a CI/CD tool access to Deployments in the staging namespace).
   
   
3. 
   ClusterRole + ClusterRoleBinding:
   
   Use for cluster-wide access (e.g., granting cluster admin privileges).
   

Best Practices

1. 
   Principle of Least Privilege: Grant only the permissions users or services need.
   
   
2. 
   Use Namespaces: Isolate resources and permissions using namespaces.
   
   
3. 
   Audit Regularly: Review Roles, ClusterRoles, and their bindings periodically.
   
   
4. 
   Avoid Wildcards: Be specific with permissions (e.g., avoid verbs: ["*"] unless absolutely necessary).
   

Источник:

Пожалуйста Авторизируйтесь или Зарегистрируйтесь для просмотра скрытого текста.