How do I give a service account permissions in Kubernetes?
Reviewed by Prabath Thalangama · Last updated
Create a Role listing the API groups, resources and verbs it may use, then bind it to the service account with a RoleBinding. For cluster-wide access use a ClusterRole and ClusterRoleBinding. This generator writes both objects for a User, Group or ServiceAccount from a short form.
RBAC permissions only add up; there is no deny rule. A subject can do anything that any of its bindings allow, so grant the smallest set of resources and verbs in a single namespace rather than wildcards or cluster-admin.
Enter core for the core API group (pods, services, secrets, configmaps), which is written as an empty string in the Role. Other resources live in named groups, such as apps for deployments and batch for jobs.
How do I generate a Role and RoleBinding?
- Choose namespaced (Role and RoleBinding) or cluster-wide (ClusterRole and ClusterRoleBinding).
- List the API groups and resources, and tick the verbs: get, list, watch, create, update, patch or delete.
- Choose the subject kind and name. For a ServiceAccount, set its namespace too.
- Apply the YAML, then confirm the result with kubectl auth can-i.
How to read the results
- Role / ClusterRole
- One rule with the API groups, resources and verbs you chose. A Role carries a namespace; a ClusterRole does not.
- RoleBinding / ClusterRoleBinding
- Connects the role to the subject through roleRef and subjects. roleRef can't be changed after creation; delete and recreate the binding to point it elsewhere.
- Subject
- User and Group subjects use apiGroup rbac.authorization.k8s.io. ServiceAccount subjects use a namespace instead.
Common RBAC errors
pods is forbidden: User cannot list resource "pods"
No binding grants list on pods in that namespace. Check that the Role is in the same namespace as the pods, and that the verb list includes list.
Error from server (Forbidden): pods is forbidden: User "system:serviceaccount:ci:deployer" cannot list resource "pods" in API group "" in the namespace "prod"Deployments are still forbidden after granting the core group
Deployments are in the apps API group, not core. Add apps to the API groups.
cannot change roleRef
roleRef is immutable. Delete the binding and create it again with the new role.
Examples and command-line equivalents
Check what a service account can do
kubectl auth can-i list pods -n prod --as=system:serviceaccount:ci:deployer
kubectl auth can-i --list -n prod --as=system:serviceaccount:ci:deployerCreate the same objects with kubectl
kubectl create role pod-reader --verb=get,list,watch --resource=pods -n prod
kubectl create rolebinding pod-reader --role=pod-reader --serviceaccount=ci:deployer -n prodFrequently asked questions
How do I test what a service account can do?
kubectl auth can-i list pods --as=system:serviceaccount:my-namespace:my-sa -n my-namespace answers yes or no for a specific action, and --list shows everything it may do there.
Role or ClusterRole?
Use a Role for permissions inside one namespace. Use a ClusterRole for cluster-scoped resources such as nodes or namespaces, or to define a permission set once and bind it in several namespaces with RoleBindings.
Can I deny a permission with RBAC?
No. RBAC rules only grant. To restrict a subject, remove or narrow the bindings that give it access.