What is Role in Kubernetes: Definition and Usage

In Kubernetes, a Role is a set of permissions that define what actions a user or service can perform within a specific namespace. It controls access to resources like pods, services, and secrets by specifying allowed operations such as get, list, or create.

How It Works

Think of a Role in Kubernetes like a job description for someone working in an office. It clearly states what tasks they are allowed to do and what areas they can access. In Kubernetes, a Role lists permissions for actions on resources within a single namespace, such as reading pod details or creating services.

When a user or application tries to perform an action, Kubernetes checks the Roles assigned to them to see if the action is allowed. This helps keep the cluster secure by only letting users do what they are permitted to do, similar to how a keycard only opens certain doors in a building.

Example

This example shows a Role that allows reading pods and listing services in the "default" namespace.

yaml

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["get", "list"]

When to Use

Use a Role when you want to control permissions within a specific namespace in your Kubernetes cluster. For example, if you have a team responsible for managing pods in the "development" namespace, you can create a Role that only allows pod-related actions there.

This is useful for limiting access and reducing risks, especially in shared clusters where multiple teams or applications run. If you need to set permissions across all namespaces, you would use a ClusterRole instead.

Key Points

• A Role defines permissions within one namespace only.
• It controls what actions (verbs) can be done on which resources.
• Roles are used with RoleBindings to assign permissions to users or service accounts.
• For cluster-wide permissions, use ClusterRole.

Key Takeaways

A Role sets permissions for actions on resources within a single namespace.

Roles help secure Kubernetes by limiting what users or apps can do.

Use RoleBindings to connect Roles to users or service accounts.

For permissions across all namespaces, use ClusterRole instead.

Roles specify allowed verbs like get, list, create on resources.