---
title: "RBAC Authorization"
sidebar_label: "RBAC Authorization"
sidebar_position: 3
description: "How to distribute roles between users in a cluster"
---

import Formbricks from '@theme/MDXComponents/Formbricks';

# RBAC Authorization

[RBAC Authorization](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) — a method for distributing roles between users in a Kubernetes cluster.

## Assign user roles \{#assign-user-roles}

1. Connect a [Service Account Token](/managed-kubernetes/clusters/update-certificate.mdx#configure-certificate-update-via-serviceaccount-token), as without it, you will need to download the kubeconfig file again after any role changes.

2. Assign roles.

   An example of a manifest that creates two namespaces and two users, with each user able to manage pods only within their own namespace:

   ```yaml
   apiVersion: v1
   kind: Namespace
   metadata:
       name: test-one
   ---
   apiVersion: v1
   kind: Namespace
   metadata:
       name: test-two
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
       name: read-pods-one
       namespace: test-one
   subjects:
   - kind: ServiceAccount
       name: test-sa-one
       apiGroup: ""
   roleRef:
       kind: Role
       name: pod-reader-one
       apiGroup: rbac.authorization.k8s.io
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: RoleBinding
   metadata:
       name: read-pods-two
       namespace: test-two
   subjects:
   - kind: ServiceAccount
       name: test-sa-two
       apiGroup: ""
   roleRef:
       kind: Role
       name: pod-reader-two
       apiGroup: rbac.authorization.k8s.io
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
       namespace: test-one
       name: pod-reader-one
   rules:
   - apiGroups: [""] # "" indicates the core API group
       resources: ["pods"]
       verbs: ["get", "watch", "list"]
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: Role
   metadata:
       namespace: test-two
       name: pod-reader-two
   rules:
   - apiGroups: [""] # "" indicates the core API group
       resources: ["pods"]
       verbs: ["get", "watch", "list"]
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
       namespace: test-one
       name: test-sa-one
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
       namespace: test-two
       name: test-sa-two
   ```

3. Apply the manifest.

4. Create tokens:

   ```bash
   kubectl get secret $(kubectl get serviceaccount test-sa-one -o jsonpath='{.secrets[0].name}' --namespace test-one) -o jsonpath='{.data.token}' --namespace test-one | base64 -d
   <long and secure token for test-sa-one>

   kubectl get secret $(kubectl get serviceaccount test-sa-two -o jsonpath='{.secrets[0].name}' --namespace test-two) -o jsonpath='{.data.token}' --namespace test-two | base64 -d
   <long and secure token for test-sa-two>
   ```

5. Manually add tokens to users in the `kubeconfig.yaml` file for passwordless authorization:

   ```yaml
   users:
   ...
   - name: test-sa-one
     user:
       token: long and secure token test-sa-one
   - name: test-sa-two
     user:
       token: long and secure token test-sa-two
   ...
   ```

6. Check that role distribution works:

   ```bash
   kubectl config set-context --current --user=test-sa-two
   Context "admin@kubernetes" modified.

   kubectl get pods --namespace test-two
   No resources found in test-two namespace.

   kubectl get pods --namespace test-one
   Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:test-two:test-sa-two" cannot list resource "pods" in API group "" in the namespace "test-one"
   ________

   kubectl config set-context --current --user=test-sa-one
   Context "admin@kubernetes" modified.

   kubectl get pods --namespace test-two
   Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:test-one:test-sa-one" cannot list resource "pods" in API group "" in the namespace "test-two"

   kubectl get pods --namespace test-one
   No resources found in test-one namespace.
   ```

   Now the user test-sa-two has access to pods in the test-two namespace and does not have access in the test-one namespace. The user test-sa-one has the opposite.

<Formbricks />