What is RBAC? | DevOps Dictionary

RBAC — Controlling Who Can Do What in Kubernetes

The Four RBAC Objects — Explained Simply

◈ DIAGRAM

+---------------------------+     +---------------------------+     +---------------------------+
| WHO                       |     | WHAT (permissions)        |     | SCOPE                     |
|                           |     |                           |     |                           |
| ServiceAccount            |     | Role                      |     | One namespace only        |
| User                      | --> | ClusterRole               | --> | Entire cluster            |
| Group                     |     |                           |     |                           |
+---------------------------+     +---------------------------+     +---------------------------+
 
Binding objects connect WHO to WHAT:
+------------------------------------------+
| RoleBinding        -> Role or ClusterRole in ONE namespace   |
| ClusterRoleBinding -> ClusterRole across ALL namespaces      |
+------------------------------------------+

A Concrete Team Setup — PhonePe Multi-Team Cluster

PhonePe has three teams sharing one cluster, each with different access needs:

◈ DIAGRAM

+------------------------+    +------------------------+    +------------------------+
| payments-team          |    | platform-team          |    | ci-bot                 |
|                        |    |                        |    |                        |
| manage pods/deploys    |    | read across all        |    | update deployments     |
| in their namespace     |    | namespaces to debug    |    | (image tags) only      |
| only                   |    |                        |    |                        |
+------------------------+    +------------------------+    +------------------------+

YAML

1# ── SCENARIO 1: Namespace-scoped developer access ──
2apiVersion: rbac.authorization.k8s.io/v1
3kind: Role
4metadata:
5  name: developer
6  namespace: payments-prod
7rules:
8  - apiGroups: ["apps", ""]
9    resources: ["deployments", "pods", "services", "configmaps"]
10    verbs: ["get", "list", "watch", "create", "update", "patch"]
11  - apiGroups: [""]
12    resources: ["secrets"]
13    verbs: ["get", "list"]              # Can READ secrets, not create or delete them
14---
15apiVersion: rbac.authorization.k8s.io/v1
16kind: RoleBinding
17metadata:
18  name: payments-developer-binding
19  namespace: payments-prod
20subjects:
21  - kind: User
22    name: rahul@devops.in               # A specific engineer
23    apiGroup: rbac.authorization.k8s.io
24roleRef:
25  kind: Role
26  name: developer
27  apiGroup: rbac.authorization.k8s.io

YAML

1# ── SCENARIO 2: Cluster-wide read-only for platform team ──
2apiVersion: rbac.authorization.k8s.io/v1
3kind: ClusterRole
4metadata:
5  name: platform-readonly
6rules:
7  - apiGroups: ["*"]
8    resources: ["*"]
9    verbs: ["get", "list", "watch"]     # Read everything, touch nothing
10---
11apiVersion: rbac.authorization.k8s.io/v1
12kind: ClusterRoleBinding
13metadata:
14  name: platform-team-binding
15subjects:
16  - kind: Group
17    name: platform-engineers            # Entire group — not individual users
18    apiGroup: rbac.authorization.k8s.io
19roleRef:
20  kind: ClusterRole
21  name: platform-readonly
22  apiGroup: rbac.authorization.k8s.io

YAML

1# ── SCENARIO 3: CI bot — only update deployments ──
2apiVersion: rbac.authorization.k8s.io/v1
3kind: Role
4metadata:
5  name: ci-deployer
6  namespace: payments-prod
7rules:
8  - apiGroups: ["apps"]
9    resources: ["deployments"]
10    verbs: ["get", "patch", "update"]   # Just enough to update image tags
11---
12apiVersion: rbac.authorization.k8s.io/v1
13kind: RoleBinding
14metadata:
15  name: ci-bot-binding
16  namespace: payments-prod
17subjects:
18  - kind: ServiceAccount
19    name: github-actions-bot
20    namespace: payments-prod
21roleRef:
22  kind: Role
23  name: ci-deployer
24  apiGroup: rbac.authorization.k8s.io

The Verbs Cheatsheet

Verb	What it allows
`get`	Read a specific named resource
`list`	List all resources of a type
`watch`	Stream changes to resources in real-time
`create`	Create new resources
`update`	Replace an entire resource object
`patch`	Modify specific fields of a resource
`delete`	Delete a single resource
`deletecollection`	Delete all resources matching a selector
`*`	All verbs — full admin access, use sparingly

How RBAC Request Evaluation Works

◈ DIAGRAM

+------------------------------------------+
| kubectl request arrives at API server    | <- e.g. rahul tries to delete a Secret
+------------------------------------------+
                    |
                    v
+------------------------------------------+
| Authentication: who is making this call? | <- Certificate, token, or kubeconfig
+------------------------------------------+
                    |
                    v
+------------------------------------------+
| Authorization: is this action allowed?   | <- RBAC checks Role/ClusterRole rules
+------------------------------------------+
            |               |
            v               v
    +------------+    +------------+
    | ALLOWED    |    | FORBIDDEN  |
    | 200 OK     |    | 403 Error  |
    +------------+    +------------+

Testing RBAC Without Guessing

Bash

1# Can the GitHub Actions SA update deployments in payments-prod?
2kubectl auth can-i update deployments \
3  --as=system:serviceaccount:payments-prod:github-actions-bot \
4  -n payments-prod
5# Output: yes
6 
7# Can it delete pods? (should be no)
8kubectl auth can-i delete pods \
9  --as=system:serviceaccount:payments-prod:github-actions-bot \
10  -n payments-prod
11# Output: no
12 
13# Full dump of everything YOUR current user can do in a namespace
14kubectl auth can-i --list -n payments-prod
15 
16# List all RoleBindings in a namespace to audit who has what
17kubectl get rolebindings -n payments-prod -o wide
18 
19# Find all ClusterRoleBindings that grant cluster-admin
20kubectl get clusterrolebindings -o json | \
21  jq '.items[] | select(.roleRef.name=="cluster-admin") | .subjects'

Common RBAC Mistakes

Mistake	Consequence	Fix
Using `ClusterRoleBinding` for team access	Team can read secrets in all namespaces	Use `RoleBinding` scoped to their namespace only
Granting `` verbs on `` resources	Full cluster admin for app pods	List exact verbs and resources — least privilege
Forgetting the `apiGroups` field	Rules silently do not apply	Use `""` for core resources, `"apps"` for Deployments
Binding `cluster-admin` to CI service accounts	Compromised pipeline = full cluster takeover	Create a minimal `ci-deployer` Role with only patch/update on deployments
Not auditing RBAC after team changes	Departed engineers retain access	Audit bindings quarterly with `kubectl get rolebindings -A`

⚠️ Security: Never grant * verbs on secrets to non-admin users or service accounts. Secrets contain database passwords, API keys, and TLS certificates. On a Zerodha-scale trading platform, a compromised pod with secret read access can exfiltrate every downstream service credential in minutes.

💡 Tip: Run kubectl auth can-i --list -n <namespace> to get a full dump of what your current user is allowed to do. This is the fastest way to debug a 403 Forbidden error in a CI pipeline without reading through 10 YAML files.

📌 Remember: RoleBinding can reference a ClusterRole — and this is intentional. Define a ClusterRole with standard developer permissions once, then bind it per-namespace with individual RoleBindings. This avoids duplicating Role YAML across every team namespace.

🔴 Common Mistake: Granting cluster-admin to service accounts used by CI tools like GitHub Actions or ArgoCD. If the pipeline is compromised, the attacker has unrestricted access to the entire cluster. Always create a minimal ci-deployer Role with exactly the verbs the pipeline needs — nothing more.

Syncing Data

RBAC

Technical Explanation & Usage

RBAC — Controlling Who Can Do What in Kubernetes

The Four RBAC Objects — Explained Simply

A Concrete Team Setup — PhonePe Multi-Team Cluster

The Verbs Cheatsheet

How RBAC Request Evaluation Works

Testing RBAC Without Guessing

Common RBAC Mistakes

Related Terms

Namespace

Pod

Deployment