RBAC Reference

Kubernetes RBAC (Role-Based Access Control) controls who can do what on the API server. Permissions are defined in Roles and bound to identities through Bindings.

RBAC is enabled by default since Kubernetes 1.8 and is the standard authorization mode for production clusters.

Roles define a set of permissions: which verbs (actions) on which resources.

• Role -- namespace-scoped, grants access within a single namespace
• ClusterRole -- cluster-wide, can grant access across all namespaces or to cluster-scoped resources

Bindings connect Roles to Identities, granting the role's permissions to the bound subjects.

• ClusterRoleBinding -- grants cluster-wide access
• RoleBinding -- grants namespace-scoped access

A ClusterRole can be referenced by a RoleBinding to grant its permissions within a single namespace only.

Three types of identities can be granted permissions:

• Users -- human accounts from external authentication (certificates, OIDC, etc.)
• Groups -- collections of users (e.g., system:masters)
• ServiceAccounts -- technical identity for pods, managed by Kubernetes

Roles and RoleBindings are limited to a namespace. ClusterRoles and ClusterRoleBindings apply cluster-wide.

A ClusterRole can be referenced by a RoleBinding to grant its permissions within a single namespace -- this is a common pattern for reusable permission sets.