RBACCluster Roles

Cluster Roles

Cluster Roles define permissions that apply across the entire cluster. They can grant access to cluster-scoped resources or resources in all namespaces.

Cluster Roles Overview
Cluster Roles management interface showing cluster-wide permissions

Overview

The Cluster Roles view displays all cluster roles with the following information:

ColumnDescription
NameThe cluster role identifier
RulesNumber of permission rules in the cluster role
PermissionsResources and actions the cluster role grants access to
AgeWhen the cluster role was created
ActionsEdit or delete the cluster role

Features

Search

Use the search bar to quickly find cluster roles by name.

Create Cluster Role

Click + Create Cluster Role to define a new cluster role with custom permissions.

When to Use Cluster Roles

Use Cluster Roles when you need to:

  1. Grant access to cluster-scoped resources - Resources like nodes, persistent volumes, or namespaces that exist outside any namespace
  2. Grant access across all namespaces - When users need the same permissions in every namespace
  3. Define reusable permission sets - Cluster Roles can be referenced by Role Bindings in any namespace

Built-in Cluster Roles

Kubernetes includes several default cluster roles:

RoleDescription
cluster-adminFull access to all resources in the cluster
adminFull access within a namespace (when bound with RoleBinding)
editRead/write access to most resources in a namespace
viewRead-only access to most resources in a namespace

Example Cluster Role

A cluster role that allows reading nodes and persistent volumes:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes", "persistentvolumes"]
  verbs: ["get", "list", "watch"]

Best Practices

  1. Use built-in roles when possible - Kubernetes provides well-designed default roles
  2. Be cautious with cluster-admin - This role has unrestricted access
  3. Document custom cluster roles - Explain why each permission is needed
  4. Regular audits - Review cluster roles periodically to ensure they’re still necessary
RolesCluster Role Bindings