-
Book Overview & Buying
-
Table Of Contents
The Platform Engineer's Handbook
By :
Let us first start with the fundamentals around Kubernetes RBAC in simple terms. This define what actions are allowed on which resources and the required permissions are bound to the users or groups. A Role, and ClusterRole defines permissions in a namespace and for the entire cluster respectively. Similarly RoleBindings and ClusterRoleBindings grant permissions across a namespace and a whole cluster. Kubernetes generally make it easy by ensuring that if a permission isn't explicitly granted, its assumed to be denied, instead of having specific deny rules, which is why we call it a zero trust architecture.
As Maria's team needs full cluster access to troubleshoot cross-namespace issues, diagnose control plane problems and handle any emergencies. So, they would need platform-admin permissions. Developers on the other hand get namespace-scoped access. Full control within their assigned namespaces but nothing else beyond that...