What is rbac in kubernetes

What is RBAC in Kubernetes?

RBAC (Role-Based Access Control) is a Kubernetes security feature that controls who can access what resources and perform which actions within a cluster. It's essential for securing multi-tenant Kubernetes environments and ensuring that users and applications only have the permissions they need.

Core RBAC Components

RBAC consists of four main components: Role (defines permissions in a namespace), ClusterRole (defines cluster-wide permissions), RoleBinding (grants Role permissions to users/service accounts in a namespace), and ClusterRoleBinding (grants ClusterRole permissions cluster-wide). Together, these components create a comprehensive permission system.

How RBAC Works

When a user or pod attempts to access a Kubernetes resource, the API server checks RBAC policies. The request includes the user identity, requested resource, and desired action (verb). The system verifies if a RoleBinding or ClusterRoleBinding grants the necessary permissions. If no matching role grants access, the request is denied.

Roles and Permissions

Roles define specific permissions using rules that specify resources, API groups, and verbs. Common verbs include get, list, create, update, patch, delete, and watch. For example, a role might grant permissions to get and list pods, but not delete them. ClusterRoles work identically but apply cluster-wide rather than to a single namespace.

Service Accounts and RBAC

Service accounts are Kubernetes identities used by pods to authenticate with the API server. Each pod automatically mounts a service account token. By binding roles to service accounts, you control what each pod can access. This is critical for least-privilege access, ensuring applications only access necessary resources.