What are some examples of Kubernetes RBAC?

What are some examples of Kubernetes RBAC?

Kubernetes RBAC (Role-Based Access Control) allows you to define permissions for users and applications. For example, you can create a role that allows users to read pods in a specific namespace.

Can you show me how to create a role and a role binding?

Sure! To create a role, you can use the following YAML:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: my-namespace
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list"]

Then, to bind this role to a user, you can create a RoleBinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: my-namespace
subjects:
- kind: User
  name: my-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

What is the difference between Role and ClusterRole?

A Role is namespace-specific, meaning it only applies to resources within a particular namespace. In contrast, a ClusterRole can be used across all namespaces and can also grant permissions to cluster-wide resources.

Can I use RBAC with service accounts?

Yes, you can use RBAC with service accounts. You can create a Role or ClusterRole and bind it to a service account using RoleBinding or ClusterRoleBinding, respectively.