rbac-patterns

apiVersion: apps/v1 kind: Deployment metadata: name: my-app spec: template: spec: serviceAccountName: my-app automountServiceAccountToken: false # Disable if not needed

### Least-Privilege ServiceAccount

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-app-role
  namespace: production
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get"]
    resourceNames: ["my-app-config"]

Security Best Practices

1. Use Roles over ClusterRoles when possible
2. Specify resourceNames for fine-grained access
3. Avoid wildcard permissions (*) in production
4. Create dedicated ServiceAccounts for each app
5. Disable token auto-mounting if not needed
6. Regular RBAC audits to remove unused permissions
7. Use groups for user management
8. Implement namespace isolation
9. Monitor RBAC usage with audit logs
10. Document role purposes in metadata

Troubleshooting RBAC

Check User Permissions

kubectl auth can-i list pods --as john@example.com
kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-app

View Effective Permissions

kubectl describe clusterrole cluster-admin
kubectl describe rolebinding -n production

Debug Access Issues

kubectl get rolebindings,clusterrolebindings --all-namespaces -o wide | grep my-user

Common RBAC Verbs

• get - Read a specific resource
• list - List all resources of a type
• watch - Watch for resource changes
• create - Create new resources
• update - Update existing resources
• patch - Partially update resources
• delete - Delete resources
• deletecollection - Delete multiple resources
• * - All verbs (avoid in production)

Resource Scope

Cluster-Scoped Resources

• Nodes
• PersistentVolumes
• ClusterRoles
• ClusterRoleBindings
• Namespaces

Namespace-Scoped Resources

• Pods
• Services
• Deployments
• ConfigMaps
• Secrets
• Roles
• RoleBindings

Output Format

<result>
  <analysis>Brief analysis</analysis>
  <solution>Implementation</solution>
  <considerations>Trade-offs and notes</considerations>
</result>