← All notes

Answer: Permissions are purely additive: there are no deny rules.

Four objects

| Object | Scope | |---|---| | Role | one namespace | | ClusterRole | cluster-wide (non-namespaced) | | RoleBinding | grants within one namespace | | ClusterRoleBinding | grants cluster-wide |

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata: {namespace: dev, name: pod-reader}
rules:
- apiGroups: [""]
  resources: [pods]
  verbs: [get, list, watch]

Good practices

• Avoid providing wildcard permissions when possible, especially to all resources. (S2)
• Limit cluster-admin bindings.

Check access

kubectl auth can-i list pods --as=system:serviceaccount:dev:app -n dev

Claims

• id: C1 claim: RBAC permissions are purely additive. source: S1 evidence: "Permissions are purely additive (there are no"
• id: C2 claim: A Role always sets permissions within a namespace. source: S1 evidence: "A Role always sets permissions within a particular namespace;"
• id: C3 claim: ClusterRole is a non-namespaced resource. source: S1 evidence: "ClusterRole, by contrast, is a non-namespaced resource."
• id: C4 claim: Avoid providing wildcard permissions when possible. source: S2 evidence: "Avoid providing wildcard permissions when possible, especially to all resources."

Sources

• [S1] Using RBAC Authorization. Kubernetes Authors. https://kubernetes.io/docs/reference/access-authn-authz/rbac/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.
• [S2] Role Based Access Control Good Practices. Kubernetes Authors. https://kubernetes.io/docs/concepts/security/rbac-good-practices/ . License: CC BY 4.0 (kubernetes/website). Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_mv0m1bjn,
  author = {{iinventedlight}},
  title = {{Kubernetes RBAC}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/kubernetes-rbac/},
  note = {Permanent ID iil:note:mv0m1bjn. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/kubernetes-rbac.md.