RoleBindings and ClusterRoleBindings in Kubernetes - Step-by-Step Execution

Process Flow - RoleBindings and ClusterRoleBindings

Define Role or ClusterRole

↓

Create RoleBinding or ClusterRoleBinding

↓

Bind Role to User/Group/ServiceAccount

↓

Access Permissions Granted

↓

User performs actions allowed by Role

↓

Check permissions enforced by Kubernetes

This flow shows how Roles or ClusterRoles are bound to users or groups via RoleBindings or ClusterRoleBindings to grant permissions.

Execution Sample

Kubernetes

kubectl create rolebinding read-pods \
  --role=view \
  --user=jane \
  --namespace=dev

This command creates a RoleBinding named 'read-pods' that binds the 'view' Role to user 'jane' in the 'dev' namespace.

Process Table

Step	Command/Action	Resource Created	Scope	Binding Target	Effect
1	kubectl create role view --verb=get,list --resource=pods --namespace=dev	Role 'view'	Namespace: dev	N/A	Defines permissions to get and list pods
2	kubectl create rolebinding read-pods --role=view --user=jane --namespace=dev	RoleBinding 'read-pods'	Namespace: dev	User 'jane'	Binds Role 'view' to user 'jane' in dev namespace
3	User 'jane' runs 'kubectl get pods -n dev'	N/A	Namespace: dev	User 'jane'	Allowed: can list pods as per Role
4	User 'jane' runs 'kubectl get pods -n prod'	N/A	Namespace: prod	User 'jane'	Denied: no RoleBinding in prod namespace
5	kubectl create clusterrolebinding admin-binding --clusterrole=admin --user=jane	ClusterRoleBinding 'admin-binding'	Cluster-wide	User 'jane'	Binds ClusterRole 'admin' to user 'jane' cluster-wide
6	User 'jane' runs 'kubectl delete pod xyz -n prod'	N/A	Namespace: prod	User 'jane'	Allowed: admin ClusterRole grants delete pods anywhere
7	User 'bob' runs 'kubectl get pods -n dev'	N/A	Namespace: dev	User 'bob'	Denied: no RoleBinding or ClusterRoleBinding for bob
8	END	N/A	N/A	N/A	Execution stops: all bindings created and tested

💡 Execution stops after all RoleBindings and ClusterRoleBindings are created and tested for user permissions.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 5	Final
Role 'view'	None	Created with get,list pods in dev	Same	Same	Defined permissions for pods in dev
RoleBinding 'read-pods'	None	None	Created binding 'view' to jane in dev	Same	Binding exists in dev namespace
ClusterRoleBinding 'admin-binding'	None	None	None	Created binding 'admin' to jane cluster-wide	Binding exists cluster-wide
User 'jane' permissions	None	Can get,list pods in dev	Same	Can admin cluster-wide	Permissions updated cluster-wide
User 'bob' permissions	None	None	None	None	No permissions assigned

Key Moments - 3 Insights

Why can user 'jane' list pods in 'dev' but not in 'prod' after creating a RoleBinding?

RoleBindings apply only within a specific namespace. The RoleBinding 'read-pods' is created in 'dev' namespace, so 'jane' has permissions there but not in 'prod' (see execution_table rows 2,3,4).

What is the difference between RoleBinding and ClusterRoleBinding?

RoleBinding grants permissions within a namespace, while ClusterRoleBinding grants permissions cluster-wide (see execution_table rows 2 and 5).

Why can 'jane' delete pods in 'prod' after ClusterRoleBinding creation?

ClusterRoleBinding binds the 'admin' ClusterRole to 'jane' cluster-wide, allowing actions like deleting pods in any namespace (see execution_table row 6).

Visual Quiz - 3 Questions

Look at the execution table, at which step does 'jane' gain cluster-wide admin permissions?

A Step 3

B Step 2

C Step 5

D Step 4

💡 Hint

Check the 'Resource Created' and 'Effect' columns in execution_table row 5.

According to variable_tracker, what is the state of 'RoleBinding read-pods' after step 2?

A Created binding 'view' to jane in dev

B Deleted

C Not created yet

D Created cluster-wide

💡 Hint

Look at the 'RoleBinding read-pods' row under 'After Step 2' in variable_tracker.

If we remove the ClusterRoleBinding at step 5, what happens when 'jane' tries to delete pods in 'prod'?

A Allowed because RoleBinding applies cluster-wide

B Denied because no cluster-wide permissions

C Allowed because 'view' Role includes delete

D Denied because 'jane' is not a user

💡 Hint

Refer to execution_table rows 5 and 6 about ClusterRoleBinding and permissions.

Concept Snapshot

RoleBindings bind Roles to users/groups within a namespace.
ClusterRoleBindings bind ClusterRoles cluster-wide.
Roles define permissions on resources.
RoleBindings and ClusterRoleBindings grant those permissions.
Namespace scope limits RoleBindings.
ClusterRoleBindings apply across all namespaces.

Full Transcript

This visual execution traces how Kubernetes RoleBindings and ClusterRoleBindings work. First, a Role is created with permissions scoped to a namespace. Then, a RoleBinding binds that Role to a user in that namespace, granting permissions only there. The user can perform allowed actions in that namespace but not others. Next, a ClusterRoleBinding binds a ClusterRole to the user cluster-wide, granting permissions across all namespaces. The user can then perform admin actions anywhere. Another user without bindings has no permissions. This shows the difference in scope and how bindings control access.