Kubernetes RBAC - Ankra Platform

The RBAC (Role-Based Access Control) section helps you understand and manage access control in your Kubernetes cluster.

Overview

Kubernetes RBAC controls who can do what in your cluster:

Roles - Namespace-scoped permissions
ClusterRoles - Cluster-wide permissions
RoleBindings - Grant Roles to users/groups in a namespace
ClusterRoleBindings - Grant ClusterRoles cluster-wide
ServiceAccounts - Identities for pods and services

Accessing RBAC Resources

Navigate to your cluster and click Kubernetes in the sidebar. RBAC resources include:

Resource	Path
Roles	Kubernetes → Roles
ClusterRoles	Kubernetes → Cluster Roles
RoleBindings	Kubernetes → Role Bindings
ClusterRoleBindings	Kubernetes → Cluster Role Bindings
ServiceAccounts	Kubernetes → Service Accounts

Roles and ClusterRoles

Roles define what actions are allowed on which resources.

Roles (Namespace-scoped)

Roles grant permissions within a specific namespace.

Column	Description
Name	Role name
Namespace	Namespace where role exists
Rules	Number of permission rules
Age	Time since creation

ClusterRoles (Cluster-wide)

ClusterRoles grant permissions across all namespaces or on cluster-scoped resources.

Column	Description
Name	ClusterRole name
Rules	Number of permission rules
Aggregation	Whether it aggregates other roles
Age	Time since creation

Rule Details

Click a Role or ClusterRole to view its rules:

Field	Description
API Groups	Which API groups (`""` for core, `apps`, `batch`, etc.)
Resources	Resource types (`pods`, `deployments`, `secrets`, etc.)
Verbs	Allowed actions (`get`, `list`, `create`, `update`, `delete`, etc.)
Resource Names	Specific resource names (optional)

Common Verbs

Verb	Description
`get`	Read a single resource
`list`	List resources
`watch`	Watch for changes
`create`	Create new resources
`update`	Modify existing resources
`patch`	Partially update resources
`delete`	Remove resources
`deletecollection`	Delete multiple resources

Built-in ClusterRoles

Role	Description
`cluster-admin`	Full cluster access
`admin`	Full namespace access
`edit`	Read/write most resources
`view`	Read-only access

RoleBindings and ClusterRoleBindings

Bindings connect Roles to users, groups, or service accounts.

RoleBindings (Namespace-scoped)

Grant a Role’s permissions within a specific namespace.

Column	Description
Name	Binding name
Namespace	Namespace where binding applies
Role	Referenced Role or ClusterRole
Subjects	Users, groups, or service accounts
Age	Time since creation

ClusterRoleBindings (Cluster-wide)

Grant a ClusterRole’s permissions across all namespaces.

Column	Description
Name	Binding name
Role	Referenced ClusterRole
Subjects	Users, groups, or service accounts
Age	Time since creation

Subject Types

Type	Description
User	Individual user identity
Group	Group of users
ServiceAccount	Kubernetes service account

Binding Details

Click a binding to view:

Role Reference - The Role or ClusterRole being granted
Subjects - Who receives the permissions

ServiceAccounts

ServiceAccounts provide identities for pods and applications.

Viewing ServiceAccounts

Column	Description
Name	ServiceAccount name
Namespace	Kubernetes namespace
Secrets	Number of associated secrets
Age	Time since creation

ServiceAccount Details

Click a ServiceAccount to view:

Secrets - Associated token secrets
Image Pull Secrets - Registry credentials
Automount Token - Whether token is auto-mounted to pods
Used By - Pods using this service account

Default ServiceAccount

Every namespace has a default ServiceAccount. Pods use it unless another is specified:

spec:
  serviceAccountName: my-service-account

Common Patterns

Viewing Who Has Access

Navigate to ClusterRoleBindings or RoleBindings
Search for bindings referencing a specific role
View the Subjects to see who has that role

Checking a ServiceAccount’s Permissions

Find the ServiceAccount in Service Accounts
Navigate to RoleBindings and ClusterRoleBindings
Filter for bindings where the subject is this ServiceAccount
View the referenced Roles to see granted permissions

Least Privilege Principle

When creating new roles:

Start with minimal permissions
Add specific verbs and resources as needed
Use Roles instead of ClusterRoles when possible
Avoid wildcard (*) permissions in production

RBAC Examples

Read-only Access to Pods

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch"]

Deployment Manager

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployment-manager
  namespace: default
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

Binding to a ServiceAccount

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: deployment-manager-binding
  namespace: default
subjects:
- kind: ServiceAccount
  name: deploy-bot
  namespace: default
roleRef:
  kind: Role
  name: deployment-manager
  apiGroup: rbac.authorization.k8s.io

Troubleshooting RBAC

”Forbidden” Errors

When you see Error from server (Forbidden):

Check which user/ServiceAccount is making the request
Find bindings for that subject
Verify the Role includes the necessary verb and resource
Check the correct namespace for RoleBindings

Debugging Steps

Check the user/SA:
- What identity is making the request?
Find bindings:
- Search RoleBindings/ClusterRoleBindings for the subject
Check the Role:
- Verify rules include the required verb + resource
Namespace scope:
- Is it a namespaced resource? Is the RoleBinding in the right namespace?

Tips

Use Groups: Bind roles to groups rather than individual users for easier management.

Audit Bindings: Regularly review ClusterRoleBindings for cluster-admin access.

Namespace Isolation: Use Roles and RoleBindings to isolate teams to their namespaces.

Service Account Tokens: Disable automounting of tokens for pods that don’t need cluster access.

Still have questions? Join our Slack community and we’ll help out.

​Overview

​Accessing RBAC Resources

​Roles and ClusterRoles

​Roles (Namespace-scoped)

​ClusterRoles (Cluster-wide)

​Rule Details

​Common Verbs

​Built-in ClusterRoles

​RoleBindings and ClusterRoleBindings

​RoleBindings (Namespace-scoped)

​ClusterRoleBindings (Cluster-wide)

​Subject Types

​Binding Details

​ServiceAccounts

​Viewing ServiceAccounts

​ServiceAccount Details

​Default ServiceAccount

​Common Patterns

​Viewing Who Has Access

​Checking a ServiceAccount’s Permissions

​Least Privilege Principle

​RBAC Examples

​Read-only Access to Pods

​Deployment Manager

​Binding to a ServiceAccount

​Troubleshooting RBAC

​”Forbidden” Errors

​Debugging Steps

​Tips

Overview

Accessing RBAC Resources

Roles and ClusterRoles

Roles (Namespace-scoped)

ClusterRoles (Cluster-wide)

Rule Details

Common Verbs

Built-in ClusterRoles

RoleBindings and ClusterRoleBindings

RoleBindings (Namespace-scoped)

ClusterRoleBindings (Cluster-wide)

Subject Types

Binding Details

ServiceAccounts

Viewing ServiceAccounts

ServiceAccount Details

Default ServiceAccount

Common Patterns

Viewing Who Has Access

Checking a ServiceAccount’s Permissions

Least Privilege Principle

RBAC Examples

Read-only Access to Pods

Deployment Manager

Binding to a ServiceAccount

Troubleshooting RBAC

”Forbidden” Errors

Debugging Steps

Tips