Roles and ClusterRoles in Kubernetes - Step-by-Step Execution

Process Flow - Roles and ClusterRoles

Define Role or ClusterRole

↓

Specify permissions (verbs, resources)

↓

Create Role (namespace) or ClusterRole (cluster-wide)

↓

Bind Role or ClusterRole to user/group/serviceaccount

↓

User gains permissions as per Role or ClusterRole

↓

Access resources

This flow shows how Roles and ClusterRoles are defined with permissions, created in Kubernetes, bound to users, and then grant access.

Execution Sample

Kubernetes

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: dev
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

This Role allows reading pods in the 'dev' namespace.

Process Table

Step	Action	Resource	Scope	Result
1	Define Role 'pod-reader'	pods	namespace 'dev'	Role object created with get, watch, list verbs
2	Create Role in 'dev' namespace	pods	namespace 'dev'	Role stored in Kubernetes API
3	Bind Role to user 'alice'	pods	namespace 'dev'	User 'alice' can get, watch, list pods in 'dev'
4	Define ClusterRole 'node-reader'	nodes	cluster-wide	ClusterRole object created with get, watch, list verbs
5	Create ClusterRole in cluster scope	nodes	cluster-wide	ClusterRole stored in Kubernetes API
6	Bind ClusterRole to group 'admins'	nodes	cluster-wide	Group 'admins' can get, watch, list nodes cluster-wide
7	User 'bob' tries to list pods in 'dev'	pods	namespace 'dev'	Allowed if bound to Role or ClusterRole with pods permission
8	User 'bob' tries to list nodes	nodes	cluster-wide	Allowed if bound to ClusterRole with nodes permission
9	User 'charlie' tries to list pods in 'prod'	pods	namespace 'prod'	Denied if no Role or ClusterRole binding in 'prod'
10	End of permission checks	-	-	Access granted or denied based on bindings

💡 Execution stops after all permission checks for users are evaluated.

Status Tracker

Variable	Start	After Step 3	After Step 6	After Step 10
Role 'pod-reader'	undefined	Defined with pod read verbs in 'dev'	No change	No change
ClusterRole 'node-reader'	undefined	undefined	Defined with node read verbs cluster-wide	No change
User 'alice' permissions	none	Can get, watch, list pods in 'dev'	No change	No change
Group 'admins' permissions	none	none	Can get, watch, list nodes cluster-wide	No change
User 'bob' permissions	none	none	Depends on bindings	Evaluated for pods and nodes
User 'charlie' permissions	none	none	none	Denied for pods in 'prod'

Key Moments - 3 Insights

Why can't a Role grant permissions outside its namespace?

Because Roles are namespace-scoped as shown in execution_table step 1 and 2, they only apply within that namespace. ClusterRoles are needed for cluster-wide permissions (steps 4 and 5).

Can a ClusterRole be bound to a namespace-specific user?

Yes, ClusterRoles can be bound to users or groups in a namespace or cluster-wide. Binding determines scope of permission application (see steps 3 and 6).

Why is user 'charlie' denied access to pods in 'prod'?

Because no Role or ClusterRole with pod permissions is bound to 'charlie' in 'prod' namespace (step 9), so access is denied.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the Role 'pod-reader' created in Kubernetes?

A Step 1

B Step 4

C Step 2

D Step 5

💡 Hint

Check the 'Action' column for Role creation in namespace 'dev'.

According to variable_tracker, what permissions does user 'alice' have after step 3?

A Can get, watch, list pods in 'dev'

B Can get, watch, list nodes cluster-wide

C No permissions

D Can list pods in 'prod'

💡 Hint

Look at 'User alice permissions' row after step 3.

If we bind the ClusterRole 'node-reader' to user 'bob' at step 6, what happens at step 8?

A User 'bob' is denied access to nodes

B User 'bob' can list nodes cluster-wide

C User 'bob' can list pods in 'dev'

D User 'bob' can list pods in 'prod'

💡 Hint

Check execution_table step 6 and 8 for ClusterRole binding and access.

Concept Snapshot

Roles and ClusterRoles define permissions in Kubernetes.
Roles are namespace-scoped; ClusterRoles are cluster-wide.
Bind them to users/groups to grant access.
Use RoleBindings for Roles, ClusterRoleBindings for ClusterRoles.
Permissions specify verbs (get, list) on resources (pods, nodes).

Full Transcript

This visual execution trace shows how Kubernetes Roles and ClusterRoles work. First, a Role is defined with permissions limited to a namespace, like 'dev'. It is created and stored in Kubernetes. Then, a user is bound to this Role, granting them permissions in that namespace. ClusterRoles are similar but apply cluster-wide. They can be bound to users or groups to grant broader access. The execution table traces creation, binding, and permission checks for users 'alice', 'bob', and 'charlie'. Variable tracking shows how permissions change after each step. Key moments clarify common confusions about scope and bindings. The quiz tests understanding of creation steps, permission assignments, and effects of bindings. The snapshot summarizes the core ideas for quick recall.