Configure Kubernetes RBAC with service accounts and role bindings for secure cluster access control

Verify RBAC is enabled

First, confirm that RBAC authorization is active in your cluster.

kubectl cluster-info dump | grep authorization-mode
kubectl auth can-i list pods --as=system:serviceaccount:default:default

Create a dedicated namespace

Set up a separate namespace for testing RBAC configurations without affecting existing workloads.

kubectl create namespace rbac-demo
kubectl get namespaces

Create a service account

Service accounts provide identities for applications running in pods. Create one for our demo application.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-reader
  namespace: rbac-demo
  labels:
    purpose: rbac-demonstration
automountServiceAccountToken: true

kubectl apply -f rbac-service-account.yaml
kubectl get serviceaccounts -n rbac-demo

Create a role with specific permissions

Define a role that grants read-only access to pods and services within the namespace.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: rbac-demo
rules:
apiGroups: [""]
  resources: ["pods", "pods/log"]
  verbs: ["get", "list", "watch"]
apiGroups: [""]
  resources: ["services"]
  verbs: ["get", "list"]
apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["app-config"]
  verbs: ["get"]

kubectl apply -f rbac-role.yaml
kubectl describe role pod-reader -n rbac-demo

Create a role binding

Bind the role to the service account to grant the defined permissions.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: rbac-demo
subjects:
kind: ServiceAccount
  name: app-reader
  namespace: rbac-demo
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f rbac-role-binding.yaml
kubectl describe rolebinding read-pods -n rbac-demo

Create a cluster role for cross-namespace access

For permissions that span multiple namespaces, create a ClusterRole instead of a namespace-scoped Role.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-reader
rules:
apiGroups: [""]
  resources: ["namespaces"]
  verbs: ["get", "list"]
apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list"]
apiGroups: ["metrics.k8s.io"]
  resources: ["nodes", "pods"]
  verbs: ["get", "list"]

kubectl apply -f rbac-cluster-role.yaml
kubectl describe clusterrole namespace-reader

Create a cluster role binding

Bind the ClusterRole to a service account to grant cluster-wide permissions.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: read-namespaces
subjects:
kind: ServiceAccount
  name: app-reader
  namespace: rbac-demo
roleRef:
  kind: ClusterRole
  name: namespace-reader
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f rbac-cluster-role-binding.yaml
kubectl describe clusterrolebinding read-namespaces

Create a test pod with the service account

Deploy a pod that uses the service account to test the RBAC configuration.

apiVersion: v1
kind: Pod
metadata:
  name: rbac-test-pod
  namespace: rbac-demo
spec:
  serviceAccountName: app-reader
  containers:
  - name: kubectl-container
    image: bitnami/kubectl:latest
    command: ["sleep", "3600"]
  restartPolicy: Never

kubectl apply -f test-pod.yaml
kubectl get pods -n rbac-demo

Configure advanced role permissions

Create a more complex role that demonstrates resource filtering and specific action permissions.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: deployment-manager
  namespace: rbac-demo
rules:
apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update", "patch"]
apiGroups: ["apps"]
  resources: ["deployments/scale"]
  verbs: ["update", "patch"]
apiGroups: [""]
  resources: ["events"]
  verbs: ["get", "list", "watch"]
apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["app-secret", "db-secret"]
  verbs: ["get"]

kubectl apply -f advanced-role.yaml