RoleBindings and ClusterRoleBindings in Kubernetes - Time & Space Complexity

Time Complexity: RoleBindings and ClusterRoleBindings

O(n)

Understanding Time Complexity

We want to understand how the time to process RoleBindings and ClusterRoleBindings changes as the number of bindings grows.

Specifically, how does Kubernetes handle checking permissions when many bindings exist?

Scenario Under Consideration

Analyze the time complexity of the following Kubernetes RBAC snippet.

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: jane
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

This snippet binds the Role 'pod-reader' to user 'jane' in the 'default' namespace.

Identify Repeating Operations

When Kubernetes checks permissions, it looks through all RoleBindings and ClusterRoleBindings.

• Primary operation: Iterating over all RoleBindings and ClusterRoleBindings to find matching subjects and roles.
• How many times: Once per permission check, over all bindings in the relevant scope.

How Execution Grows With Input

As the number of bindings increases, Kubernetes must check more entries to find matches.

Input Size (number of bindings)	Approx. Operations
10	10 checks
100	100 checks
1000	1000 checks

Pattern observation: The number of checks grows directly with the number of bindings.

Final Time Complexity

Time Complexity: O(n)

This means the time to verify permissions grows linearly with the number of RoleBindings and ClusterRoleBindings.

Common Mistake

[X] Wrong: "Checking permissions is instant no matter how many bindings exist."

[OK] Correct: Kubernetes must look through each binding to find matches, so more bindings mean more work.

Interview Connect

Understanding how permission checks scale helps you explain system behavior and design better access controls.

Self-Check

"What if Kubernetes cached permission checks? How would that affect the time complexity?"