Cluster-level users and permissions

So far, we’ve seen Roles and RoleBindings. However, Kubernetes has four RBAC objects:

• Roles

• RoleBindings

• ClusterRoles

• ClusterRoleBindings

Roles and RoleBindings are namespaced objects. This means we apply them to specific Namespaces. On the other hand, ClusterRoles and ClusterRoleBindings are cluster-wide objects and apply to all Namespaces. All four are defined in the same API sub-group, and their YAML structures are almost identical.

A powerful pattern is to use ClusterRoles to define roles at the cluster level and then use RoleBindings to bind them to specific Namespaces. This lets us define common roles once and re-use them in specific Namespaces, as shown in the following figure.