Links: 111 KodeCloud Index

---

There are two kinds of resources: cluster scoped and namespaced.

- This is not a comprehensive list. - To list all the namespaced resources we can use k api-resources --namespaced=true - We can use k api-resources --namespace=false to view cluster scoped resources.

• We use roles and role bindings to authorise users to namespaced based resources.

• We use clusterrole and clusterrolebindings to authorise users to cluster scoped resources.

  • clusterroles are like normal roles but they are created for the whole cluster.
  • clusterroles are cluster wide and not part of any namespace.

• Sample yaml file for creating a cluster role

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
    name: cluster-administrator
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["list", "get", "get", "create", "delete"]

• Next we link the user to the cluster role by creating a cluster role binding.
• Sample yaml file for creating a cluster role binding

apiVersion:rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cluster-admin-role-binding
subjects:
- kind: User
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-administrator
  apiGroup: rbac.authorization.k8s.io

We can create a clusterrole for a namespaced resource as well.

When we do that the user will have access to these resources across all namespaces. If we create a normal role then the user will have access to resources in that namespace only.

• K8s creates some cluster roles by default.

---

Last updated: 2022-10-08