> For the complete documentation index, see [llms.txt](https://amartyushov.gitbook.io/tech/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://amartyushov.gitbook.io/tech/platforms/kubernetes/rbac.md).

# RBAC

## Role-Based Access Control

[Tutorial](https://docs.bitnami.com/tutorials/configure-rbac-in-your-kubernetes-cluster/)

Because Kubernetes RBAC is REST-based, it maps HTTP verbs to permissions. For example, POST is mapped to the create right.

The main recommendation is to give users the least privileges they need to get the job done.

Kubernetes objects are defined through different API specifications. RBAC is part of the `rbac.authorization.k8s.io`[API group](https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups-and-versioning) — this group references four different types of Kubernetes objects:

* Role, (**WHAT can be done)**
  * can be constrained to specific namespaces
* ClusterRole, (**WHAT can be done)** 
  * allows you to constrain access to resources that are cluster-wide, such as nodes
  * used for Non-resource REST Endpoints such as /healthz.
* RoleBinding, (**WHO can do it)**
* ClusterRoleBinding (**WHO can do it)**

![](https://415484505-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LxtoAXZwwOc4XGto8vb%2Fuploads%2FM0na4D4NA9eR7hQYDlbe%2FScreenshot%202022-05-16%20at%2009.09.19.png?alt=media\&token=e2cd0bd0-72cd-41a4-9d26-c43750aaf96c)

Kubernetes RBAC differentiates between human resources and software resources:

* User Accounts manage the access rights for users,
* Service Accounts manage the access rights for software resources.

How kubectl works (partly). The API server executes the following operations sequentially:

* On **receiving the request**, authenticate the user.
  * When the validation fails, reject the request by returning `401 Unauthorized`.
  * Otherwise, move on to the next stage.
* The **user is authenticated**, but do they have access to the resource?
  * If they don't, reject the request by returning `403 Forbidden`.
  * Otherwise, continue.

### Decoupling users and permission with RBAC roles