Access Control

The Access Control view provides management of Kubernetes RBAC (Role-Based Access Control) resources including Service Accounts, Roles, and Role Bindings.

Overview

Navigate to Workloads > Access Control to access:

• Service Accounts - Identities for pods and applications
• Roles - Namespace-scoped permissions
• Role Bindings - Assign roles to users/service accounts
• Cluster Roles - Cluster-wide permissions
• Cluster Role Bindings - Cluster-wide role assignments

Service Accounts

Service Accounts provide identities for processes running in pods.

Viewing Service Accounts

Navigate to Workloads > Access Control > Service Accounts.

Creating a Service Account

1. Click + Create Service Account
2. Select the target namespace
3. Enter the service account name
4. Optionally add annotations and labels
5. Click Create

Example Service Account YAML

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: production
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/my-role

Service Account Best Practices

• Create dedicated service accounts for each application
• Avoid using the default service account
• Use annotations for cloud provider integrations (AWS IRSA, GCP Workload Identity)
• Disable automounting tokens when not needed

Roles

Roles define permissions within a specific namespace.

Viewing Roles

Navigate to Workloads > Access Control > Roles.

Creating a Role

1. Click + Create Role
2. Select the target namespace
3. Enter the role name
4. Add permission rules:
   • API Groups (e.g., "", apps, batch)
   • Resources (e.g., pods, deployments, secrets)
   • Verbs (e.g., get, list, create, delete)
5. Click Create

Example Role YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]

Common Verbs

Role Bindings

Role Bindings grant the permissions defined in a Role to users or service accounts.

Viewing Role Bindings

Navigate to Workloads > Access Control > Role Bindings.

Creating a Role Binding

1. Click + Create Role Binding
2. Select the target namespace
3. Enter the binding name
4. Select the role to bind
5. Add subjects:
   • User - Kubernetes user
   • Group - User group
   • ServiceAccount - Service account in a namespace
6. Click Create

Example Role Binding YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: ServiceAccount
  name: my-app-sa
  namespace: production
- kind: User
  name: [email protected]
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Cluster Roles

Cluster Roles define permissions across the entire cluster or for non-namespaced resources.

Viewing Cluster Roles

Navigate to Workloads > Access Control > Cluster Roles.

Use Cases for Cluster Roles

• Access to non-namespaced resources (nodes, persistent volumes)
• Permissions across all namespaces
• Aggregating multiple roles together
• Defining common permission sets

Example Cluster Role YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["nodes"]
  verbs: ["get", "list"]

Cluster Role Bindings

Cluster Role Bindings grant cluster-wide permissions to users or service accounts.

Viewing Cluster Role Bindings

Navigate to Workloads > Access Control > Cluster Role Bindings.

Example Cluster Role Binding YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-nodes-global
subjects:
- kind: Group
  name: developers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: node-reader
  apiGroup: rbac.authorization.k8s.io

RBAC Best Practices

Principle of Least Privilege

• Grant only the minimum permissions needed
• Use namespace-scoped Roles instead of ClusterRoles when possible
• Avoid wildcard (*) permissions
• Regularly audit and review permissions

Organization

• Use consistent naming conventions
• Group related permissions into logical roles
• Document the purpose of custom roles
• Use labels for filtering and management

Security

• Never grant cluster-admin to applications
• Restrict access to secrets and sensitive resources
• Audit role bindings regularly
• Use separate service accounts per application

Common Patterns

Troubleshooting

Permission Denied Errors

1. Check if the service account has a role binding
2. Verify the role has the required permissions
3. Ensure the correct namespace is specified
4. Check for typos in resource names

Debugging RBAC

Use kubectl to test permissions:

# Check if a user can perform an action
kubectl auth can-i get pods --as=system:serviceaccount:default:my-sa
 
# List all permissions for a service account
kubectl auth can-i --list --as=system:serviceaccount:default:my-sa

Next Steps

• Security View - Security scanning and compliance
• Configuration View - Manage Secrets securely
• Gatekeeper - Enforce RBAC policies