Kubernetes RBAC — Control Who Can Do What in Your Cluster (2026)

# What can YOU do?
kubectl auth can-i get pods
kubectl auth can-i delete deployments
kubectl auth can-i get secrets -n production

# What can a specific user do?
kubectl auth can-i get pods --as=john.doe -n dev
kubectl auth can-i delete pods --as=john.doe -n dev  # no
kubectl auth can-i get secrets --as=john.doe -n dev  # no

# developer-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: developer-role
  namespace: dev
rules:
  - apiGroups: [""]
    resources: ["pods", "pods/log"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources: ["deployments", "replicasets"]
    verbs: ["get", "list", "watch"]
  - apiGroups: [""]
    resources: ["configmaps", "services"]
    verbs: ["get", "list"]
  # Explicitly NO access to secrets!

kubectl apply -f developer-role.yaml
kubectl describe role developer-role -n dev

# rolebinding.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-binding
  namespace: dev
subjects:
  - kind: User
    name: john.doe
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: developer-role
  apiGroup: rbac.authorization.k8s.io

kubectl apply -f rolebinding.yaml

# Test permissions
kubectl auth can-i get pods --as=john.doe -n dev    # yes ✅
kubectl auth can-i delete pods --as=john.doe -n dev  # no ✅
kubectl auth can-i get secrets --as=john.doe -n dev  # no ✅

# cluster-reader.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-reader
rules:
  - apiGroups: ["", "apps", "batch"]
    resources: ["*"]
    verbs: ["get", "list", "watch"]
  # Still NO secrets access!

# View available built-in roles
kubectl get clusterroles | grep -v system

# Common ones:
# cluster-admin  - full access (be very careful!)
# admin          - full access in namespace
# edit           - read/write most resources
# view           - read-only most resources

# Create ServiceAccount
kubectl create serviceaccount myapp-sa -n default

# Create Role with MINIMUM permissions

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: myapp-role
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get"]
    resourceNames: ["myapp-config"]  # Only THIS configmap!
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get"]
    resourceNames: ["myapp-secret"]  # Only THIS secret!

# Bind ServiceAccount to Role
kubectl create rolebinding myapp-binding \
  --role=myapp-role \
  --serviceaccount=default:myapp-sa

# Use in Deployment spec:
# serviceAccountName: myapp-sa

# Create namespace and ServiceAccount for CI/CD
kubectl create namespace ci-cd
kubectl create serviceaccount github-actions -n ci-cd

# deployer role - just enough to update deployments
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployer
rules:
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "update", "patch"]
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]

kubectl apply -f deployer-role.yaml

kubectl create clusterrolebinding github-actions-binding \
  --clusterrole=deployer \
  --serviceaccount=ci-cd:github-actions

# CI/CD can deploy but CANNOT:
# - Read secrets
# - Delete resources
# - Access other namespaces

# List all roles in namespace
kubectl get roles -n dev
kubectl get rolebindings -n dev

# List cluster-wide
kubectl get clusterroles | grep -v system
kubectl get clusterrolebindings | grep -v system

# What can a serviceaccount do?
kubectl auth can-i --list \
  --as=system:serviceaccount:default:myapp-sa

# Describe binding to see subjects
kubectl describe rolebinding developer-binding -n dev