Kubernetes RBAC Authorization Flow

Repository YAML Files:

k8s/labs/security/role.yaml — Namespace-scoped Role with rules granting API permissions.
k8s/labs/security/rolebinding.yaml — RoleBinding linking subjects (users, groups, or ServiceAccounts) to a Role.

📋 Example Scenario: User Requesting Pod Access

Request: User "jane" tries to list pods in "default" namespace

Flow: jane → kubectl get pods → API Server → Check RoleBinding → Verify pod-reader Role → Allow/Deny

Result: If jane has pod-reader RoleBinding, request is allowed ✅

2. RBAC Components (Click to view YAML)

Role

Namespace

Defines permissions within a specific namespace

RoleBinding

Namespace

Assigns a Role to users/groups/service accounts

ClusterRole

Cluster

Defines cluster-wide permissions for all namespaces

ClusterRoleBinding

Cluster

Assigns a ClusterRole cluster-wide to subjects

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: secret-reader
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "watch", "list"]

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-secrets-global
subjects:
- kind: Group
  name: managers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: secret-reader
  apiGroup: rbac.authorization.k8s.io

3. Permission Hierarchy: Namespace vs Cluster Scope

🗂️ Namespace Scope

Role: Permissions in one namespace
RoleBinding: Assigns Role in namespace
Resources: Pods, Services, ConfigMaps
Use Case: Team/project isolation

🌐 Cluster Scope

ClusterRole: Permissions across all namespaces
ClusterRoleBinding: Assigns ClusterRole globally
Resources: Nodes, PVs, Namespaces
Use Case: Cluster admin operations