Kubernetes RBAC
Kubernetes RBAC (Role-Based Access Control) is the primary authorization mechanism in every production cluster. It governs which identities — human users, groups, and ServiceAccounts — may perform which verbs on which API resources. This topic covers the full model: Role and ClusterRole definitions with their verb and resource subsets, the binding objects that attach those roles to subjects, the namespace-scoping trick of binding a ClusterRole via a RoleBinding, default and projected ServiceAccount tokens including the TokenRequest API, OIDC integration for human users through Dex or Keycloak, and cloud-provider workload identity patterns such as IRSA on EKS and Workload Identity on GKE. You will also learn the aggregated ClusterRole pattern, how the authorization mode chain (Node, RBAC, Webhook) evaluates requests, common least-privilege failures in CI/CD pipelines, and the audit tooling — kubectl-who-can, rbac-lookup, rakkess — that makes RBAC audits tractable at scale.
Sign up free to read the full topic
More DevOps topics
- Kubernetes Network Policies
- Kubernetes Networking Deep Dive
- Kubernetes Observability: Metrics, Logs, and Traces
- Kubernetes Operators & CRDs
- Kubernetes Pod Networking & CNI
- Kubernetes Pod Scheduling
- Kubernetes Runtime Classes
- Kubernetes Secrets Management
- Kubernetes Security: Pod Security and Runtime Hardening
- Kubernetes Services
- Kubernetes Storage
- Kubernetes the Hard Way
Start free on Cariara · Coding problems · System design studio