Kubectl RBAC
Least-privilege access with Roles, bindings, and auth checks.
- kubernetes rbac
- rolebinding
- serviceaccount
- can-i
- least privilege
Kubectl RBAC
Least-privilege access with Roles, bindings, and auth checks.
Commands
| Command | What it does | |
|---|---|---|
kubectl auth can-i list pods --as=dev:alice | Test someone's permission | |
kubectl get roles,rolebindings -A | Audit namespaced grants | |
| `kubectl get clusterroles | head` | Cluster-wide roles |
kubectl create role pod-reader --verb=get,list --resource=pods | Minimal read role | |
kubectl describe rolebinding pod-readers | Who holds the grant |
Example
kubectl auth can-i delete deploy --as=dev:alice --namespace=shop
kubectl create role pod-reader --verb=get,list --resource=pods -n shopFAQ
Role vs ClusterRole?
Role is namespace-scoped; ClusterRole grants cluster-wide or spans namespaces when bound with a ClusterRoleBinding.
How do CI bots authenticate?
ServiceAccounts with a dedicated RoleBinding — never share admin kubeconfigs with automation.
Perguntas frequentes
Role vs ClusterRole?
Role is namespace-scoped; ClusterRole grants cluster-wide or spans namespaces when bound with a ClusterRoleBinding.
How do CI bots authenticate?
ServiceAccounts with a dedicated RoleBinding — never share admin kubeconfigs with automation.
Kubernetes
Kubectl Config and Context
Point kubectl at the right cluster and switch contexts safely.
Kubectl Pods
Inspect pods, describe failures, and get a shell inside.
Kubectl Deployments
Create, update, and inspect Deployments that own your pods.
Kubectl Services
Expose pods stably with ClusterIP, NodePort, and LoadBalancer.