RBAC (Role-Based Access Control) is a security mechanism in Kubernetes that regulates access to cluster resources based on the roles assigned to users, groups, or service accounts. It follows the principle of least privilege, ensuring users only have the minimum permissions necessary.
RBAC consists of four main components:
- Role/ClusterRole: Defines what actions can be performed on which resources
- RoleBinding/ClusterRoleBinding: Associates roles with subjects (users, groups, service accounts)
- Subjects: The entities (users, groups, service accounts) that need access
- Resources: The Kubernetes objects being accessed (pods, services, etc.)
Example:
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: read-pods
subjects:
- kind: User
name: jane
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓
Tailored explanation · switch back to · ·
What should the new diagram focus on?