rbac-design

# Skill: RBAC Design > **Expertise:** Kubernetes RBAC — service accounts, Roles, ClusterRoles, namespace isolation, human access patterns. ## When to load When onboarding a new service, setting up CI/CD cluster access, auditing permissions, or debugging "forbidden" API errors. ## RBAC Object Hierarchy ``` ClusterRole → cluster-scoped permissions (nodes, PVs, namespaces) Role → namespace-scoped permissions (pods, services, configmaps) ClusterRoleBinding → binds ClusterRole to subject cluster-wide RoleBinding → binds Role OR ClusterRole to subject in one namespace ``` ## Workload Service Account Pattern ```yaml # 1. Dedicated ServiceAccount per workload apiVersion: v1 kind: ServiceAccount metadata: name: order-service namespace: production annotations: # For cloud IAM federation (AWS IRSA, GCP Workload Identity) eks.amazonaws.com/role-arn: arn:aws:iam::123456789:role/order-service-prod automountServiceAccountToken: false # disable unless needed --- # 2. Role — minimal permissions apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: name: order-service namespace: production rules: - apiGroups: [""] resources: ["configmaps"] verbs: ["get", "list", "watch"] resourceNames: ["order-service-config"] # scope to specific resource - apiGroups: [""] resources: ["secrets"] verbs: ["get"] resourceNames: ["order-service-tls"] --- # 3. RoleBinding apiVersion: rbac.authorization.k8s.io/v1 kind: R...