Kubernetes RBAC Tutorial: Complete Guide to Role-Based Access Control

Understanding Kubernetes RBAC

Role-Based Access Control (RBAC) is the primary authorization mechanism in Kubernetes. It controls who can do what within your clusters.

Without proper RBAC, any authenticated user or service account could read secrets, delete deployments, or modify critical configurations.

RBAC Building Blocks

Roles and ClusterRoles

A Role defines permissions within a specific namespace:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

A ClusterRole defines permissions across the entire cluster.

RoleBindings and ClusterRoleBindings

Bindings associate roles with users, groups, or service accounts:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: User
  name: [email protected]
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Common RBAC Patterns

1. Developer Access

Developers need read access to most resources and write access to their namespaces.

2. Platform Team Access

Platform teams need broader access but shouldn't have cluster-admin.

3. CI/CD Service Accounts

CI/CD pipelines need deployment access but nothing else.

4. Monitoring Service Accounts

Monitoring tools need read-only access across namespaces.

RBAC Best Practices

1. Never use cluster-admin for applications
2. Use groups instead of individual users
3. Namespace-scope permissions whenever possible
4. Audit RBAC configurations regularly
5. Use tools to detect overly permissive roles
6. Implement just-in-time access for sensitive operations

Common RBAC Mistakes

• Granting wildcard permissions (* on resources or verbs)
• Binding cluster-admin to service accounts
• Not revoking access when team members leave
• Using the default service account with elevated permissions

How SRExpert Helps with RBAC

SRExpert provides automated RBAC analysis across all your clusters. Our platform identifies overly permissive roles, unused bindings, and privilege escalation risks — helping you enforce least-privilege access at scale.