Access Control

The RBAC & Access view provides management of Kubernetes RBAC (Role-Based Access Control) resources including Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings.

Overview

Navigate to Security > RBAC & Access (route /security?view=rbac). The page is organized into tabs:

• Roles - Namespace-scoped permissions
• ClusterRoles - Cluster-wide permissions
• RoleBindings - Assign roles to users/service accounts within a namespace
• ClusterRoleBindings - Cluster-wide role assignments
• Permission Analysis - Review effective permissions across subjects
• Audit & Compliance - Audit RBAC configuration for compliance

Service Accounts

Service Accounts provide identities for processes running in pods.

Viewing Service Accounts

Service Accounts are managed from the Workloads section. (RBAC roles and bindings live under Security > RBAC & Access.)

Creating a Service Account

1. Click + Create Service Account
2. Select the target namespace
3. Enter the service account name
4. Optionally add annotations and labels
5. Click Create

Example Service Account YAML

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-app-sa
  namespace: production
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/my-role

Service Account Best Practices

• Create dedicated service accounts for each application
• Avoid using the default service account
• Use annotations for cloud provider integrations (AWS IRSA, GCP Workload Identity)
• Disable automounting tokens when not needed

Roles

Roles define permissions within a specific namespace.

Viewing Roles

Open the Roles tab under Security > RBAC & Access.

Creating a Role

1. Click + Create Role
2. Select the target namespace
3. Enter the role name
4. Add permission rules:
   • API Groups (e.g., "", apps, batch)
   • Resources (e.g., pods, deployments, secrets)
   • Verbs (e.g., get, list, create, delete)
5. Click Create

Example Role YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: production
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]

Common Verbs

Role Bindings

Role Bindings grant the permissions defined in a Role to users or service accounts.

Viewing Role Bindings

Open the RoleBindings tab under Security > RBAC & Access.

Creating a Role Binding

1. Click + Create Role Binding
2. Select the target namespace
3. Enter the binding name
4. Select the role to bind
5. Add subjects:
   • User - Kubernetes user
   • Group - User group
   • ServiceAccount - Service account in a namespace
6. Click Create

Example Role Binding YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: production
subjects:
- kind: ServiceAccount
  name: my-app-sa
  namespace: production
- kind: User
  name: [email protected]
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Cluster Roles

Cluster Roles define permissions across the entire cluster or for non-namespaced resources.

Viewing Cluster Roles

Open the ClusterRoles tab under Security > RBAC & Access.

Use Cases for Cluster Roles

• Access to non-namespaced resources (nodes, persistent volumes)
• Permissions across all namespaces
• Aggregating multiple roles together
• Defining common permission sets

Example Cluster Role YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["nodes"]
  verbs: ["get", "list"]

Cluster Role Bindings

Cluster Role Bindings grant cluster-wide permissions to users or service accounts.

Viewing Cluster Role Bindings

Open the ClusterRoleBindings tab under Security > RBAC & Access.

Example Cluster Role Binding YAML

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-nodes-global
subjects:
- kind: Group
  name: developers
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: node-reader
  apiGroup: rbac.authorization.k8s.io

RBAC Best Practices

Principle of Least Privilege

• Grant only the minimum permissions needed
• Use namespace-scoped Roles instead of ClusterRoles when possible
• Avoid wildcard (*) permissions
• Regularly audit and review permissions

Organization

• Use consistent naming conventions
• Group related permissions into logical roles
• Document the purpose of custom roles
• Use labels for filtering and management

Security

• Never grant cluster-admin to applications
• Restrict access to secrets and sensitive resources
• Audit role bindings regularly
• Use separate service accounts per application

Common Patterns

Troubleshooting

Permission Denied Errors

1. Check if the service account has a role binding
2. Verify the role has the required permissions
3. Ensure the correct namespace is specified
4. Check for typos in resource names

Debugging RBAC

Use kubectl to test permissions:

# Check if a user can perform an action
kubectl auth can-i get pods --as=system:serviceaccount:default:my-sa
 
# List all permissions for a service account
kubectl auth can-i --list --as=system:serviceaccount:default:my-sa

Next Steps

• Security View - Security scanning and compliance
• Configuration View - Manage Secrets securely
• Gatekeeper - Enforce RBAC policies