Hands-On Microservices with Kubernetes

Role-based access control

Role-based access control (RBAC) is not required! You can perform authorization using other mechanisms in Kubernetes. However, it is a best practice. RBAC is based on two concepts: role and binding. A role is a set of permissions on resources defined as rules. There are two types of roles: Role, which applies to a single namespace, and ClusterRole, which applies to all namespaces in a cluster.

Here is a role in the default namespace that allows the getting, watching, and listing of all pods. Each role has three components: API groups, resources, and verbs:

kind: RoleapiVersion: rbac.authorization.k8s.io/v1metadata:  namespace: default  name: pod-readerrules:- apiGroups: [""] # "" indicates the core API group resources: ...