---
source: https://iinventedlight.com/library/notes/kubernetes-rbac.md
title: "Kubernetes RBAC"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0 (kubernetes/website); prose restates cited source lines"
attribution: "Summary by iinventedlight (AI-assisted). Sources: Kubernetes Authors, Using RBAC Authorization, CC BY 4.0 (kubernetes/website); Kubernetes Authors, Role Based Access Control Good Practices, CC BY 4.0 (kubernetes/website)."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No code was run for this note; only the fetched documentation pages were read."
category: coding-references
topic_area: "code-ai-eng: Kubernetes"
tags: ['kubernetes', 'rbac', 'security', 'authorization']
sources:
  - id: S1
    title: "Using RBAC Authorization"
    publisher: Kubernetes Authors
    url: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
    accessed: 2026-11-04
    license: "CC BY 4.0 (kubernetes/website)"
  - id: S2
    title: "Role Based Access Control Good Practices"
    publisher: Kubernetes Authors
    url: https://kubernetes.io/docs/concepts/security/rbac-good-practices/
    accessed: 2026-11-04
    license: "CC BY 4.0 (kubernetes/website)"
---
# Kubernetes RBAC

**Answer:** Permissions are purely additive: there are no deny rules.

## Four objects

| Object | Scope |
|---|---|
| Role | one namespace |
| ClusterRole | cluster-wide (non-namespaced) |
| RoleBinding | grants within one namespace |
| ClusterRoleBinding | grants cluster-wide |

```yaml
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata: {namespace: dev, name: pod-reader}
rules:
- apiGroups: [""]
  resources: [pods]
  verbs: [get, list, watch]
```

## Good practices

- Avoid providing wildcard permissions when possible, especially to all resources. (S2)
- Limit cluster-admin bindings.

## Check access

```bash
kubectl auth can-i list pods --as=system:serviceaccount:dev:app -n dev
```

## Claims
- id: C1
  claim: RBAC permissions are purely additive.
  source: S1
  evidence: "Permissions are purely additive (there are no"
- id: C2
  claim: A Role always sets permissions within a namespace.
  source: S1
  evidence: "A Role always sets permissions within a particular namespace;"
- id: C3
  claim: ClusterRole is a non-namespaced resource.
  source: S1
  evidence: "ClusterRole, by contrast, is a non-namespaced resource."
- id: C4
  claim: Avoid providing wildcard permissions when possible.
  source: S2
  evidence: "Avoid providing wildcard permissions when possible, especially to all resources."

## Sources
- [S1] Using RBAC Authorization. Kubernetes Authors. https://kubernetes.io/docs/reference/access-authn-authz/rbac/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.
- [S2] Role Based Access Control Good Practices. Kubernetes Authors. https://kubernetes.io/docs/concepts/security/rbac-good-practices/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).