What is RBAC in Kubernetes and how do roles and role bindings work?
Understand Kubernetes RBAC: how Roles, ClusterRoles, RoleBindings and ClusterRoleBindings grant least-privilege access, with YAML examples.
Expected Interview Answer
RBAC (Role-Based Access Control) is the Kubernetes authorization mechanism that grants users and service accounts permissions to perform actions on resources, defined through Roles and bound to subjects through RoleBindings.
A Role is a namespaced set of rules listing allowed verbs (get, list, create, delete) on specific resources (pods, deployments); a ClusterRole is the cluster-scoped equivalent. A RoleBinding grants a Role's permissions to subjects (users, groups, or service accounts) within a namespace, while a ClusterRoleBinding grants a ClusterRole across the whole cluster. RBAC is additive and deny-by-default: subjects have no access until a binding grants it, and there are no deny rules.
- Enforces least-privilege access
- Fine-grained control over verbs and resources
- Namespaced and cluster-scoped scoping options
- Reusable ClusterRoles bound per-namespace
- Deny-by-default improves security posture
AI Mentor Explanation
A Role is like the rulebook clause that says a wicketkeeper may stump and catch but not bowl — it defines allowed actions on the field. A RoleBinding is the team sheet that assigns a specific player to the wicketkeeper position, so that individual gains exactly those permissions during the match and nothing more.
Step-by-Step Explanation
Step 1
Define the resources and verbs
Decide which resources (pods, secrets) and verbs (get, list, create) a subject needs.
Step 2
Create a Role or ClusterRole
Write rules; use Role for a single namespace or ClusterRole for cluster-wide or cross-namespace scope.
Step 3
Identify subjects
Determine the users, groups, or service accounts that need the permissions.
Step 4
Create a binding
Use a RoleBinding (namespaced) or ClusterRoleBinding (cluster-wide) to link subjects to the role.
Step 5
Verify access
Test with kubectl auth can-i to confirm the subject has exactly the intended permissions.
What Interviewer Expects
- Role vs ClusterRole scope difference
- RoleBinding vs ClusterRoleBinding difference
- RBAC is additive and deny-by-default (no deny rules)
- Subjects can be users, groups, or service accounts
- How to test permissions with kubectl auth can-i
Common Mistakes
- Thinking RBAC has deny rules
- Confusing Role (namespaced) with ClusterRole (cluster-wide)
- Binding a ClusterRole with a RoleBinding but expecting cluster-wide effect
- Granting cluster-admin instead of least-privilege roles
- Forgetting that permissions are additive across all bindings
Best Answer (HR Friendly)
“RBAC is how Kubernetes decides who can do what. A Role lists the allowed actions on resources, and a RoleBinding gives that Role to a specific user or service account. By default no one has access until a binding grants it, which keeps the cluster secure.”
Code Example
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: dev
name: pod-reader
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch"]apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
namespace: dev
name: read-pods-binding
subjects:
- kind: ServiceAccount
name: ci-runner
namespace: dev
roleRef:
kind: Role
name: pod-reader
apiGroup: rbac.authorization.k8s.io# Check if the service account can list pods in dev
kubectl auth can-i list pods \
--as=system:serviceaccount:dev:ci-runner -n devFollow-up Questions
- How does a ClusterRole differ from a Role?
- Can a RoleBinding reference a ClusterRole, and what is the effect?
- Why does RBAC have no deny rules?
- How do service accounts obtain their RBAC permissions?
- How would you audit who can delete secrets in a namespace?
MCQ Practice
1. What is the scope of a Role in Kubernetes RBAC?
A Role is namespaced; for cluster-wide permissions you use a ClusterRole.
2. What does a RoleBinding do?
A RoleBinding links subjects (users, groups, service accounts) to a Role within a namespace.
3. Which statement about Kubernetes RBAC is true?
RBAC has no deny rules; access is denied until a binding additively grants it.
Flash Cards
What is a Role in RBAC? — A namespaced set of rules defining allowed verbs on resources; a ClusterRole is the cluster-scoped equivalent.
What is a RoleBinding? — An object that grants a Role's permissions to subjects (users, groups, service accounts) within a namespace.
Is RBAC allow or deny based? — Additive and deny-by-default: no deny rules exist; access is granted only by bindings.
RoleBinding vs ClusterRoleBinding — RoleBinding grants access within one namespace; ClusterRoleBinding grants a ClusterRole cluster-wide.