rbac-design

Skill: RBAC Design

Expertise: Kubernetes RBAC — service accounts, Roles, ClusterRoles, namespace isolation, human access patterns.

When to load

When onboarding a new service, setting up CI/CD cluster access, auditing permissions, or debugging "forbidden" API errors.

RBAC Object Hierarchy

ClusterRole         → cluster-scoped permissions (nodes, PVs, namespaces)
Role                → namespace-scoped permissions (pods, services, configmaps)
ClusterRoleBinding  → binds ClusterRole to subject cluster-wide
RoleBinding         → binds Role OR ClusterRole to subject in one namespace

Workload Service Account Pattern

# 1. Dedicated ServiceAccount per workload
apiVersion: v1
kind: ServiceAccount
metadata:
  name: order-service
  namespace: production
  annotations:
    # For cloud IAM federation (AWS IRSA, GCP Workload Identity)
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/order-service-prod
automountServiceAccountToken: false  # disable unless needed

---
# 2. Role — minimal permissions
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: order-service
  namespace: production
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list", "watch"]
    resourceNames: ["order-service-config"]  # scope to specific resource
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
    resourceNames: ["order-service-tls"]

---
# 3. RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: order-service
  namespace: production
subjects:
  - kind: ServiceAccount
    name: order-service
    namespace: production
roleRef:
  kind: Role
  apiGroupv: rbac.authorization.k8s.io
  name: order-service

Human Access Patterns

# Dev read-only access to staging namespace
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: devs-view-staging
  namespace: staging
subjects:
  - kind: Group
    name: developers           # from OIDC provider (Dex, Okta, etc.)
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: view                   # built-in read-only ClusterRole
  apiGroup: rbac.authorization.k8s.io