[K8s] RBAC: Role, ClusterRole, ServiceAccount, RoleBinding

Kubernetes RBAC, RBAC, K8s RBAC, ServiceAccount, Role, ClusterRole, RoleBinding, ClusterRoleBinding

정의

RBAC (Role-Based Access Control) = K8s 의 권한 부여 모델. 주체 + 권한 + 바인딩.

4 객체

flowchart LR
    User[User / Group<br/>또는 ServiceAccount] -->|RoleBinding| Role
    User -->|ClusterRoleBinding| CRole[ClusterRole]
    Role -->|namespace 안| API[API resources]
    CRole -->|cluster 전체| API

객체	범위
Role	단일 namespace
ClusterRole	전체 cluster
RoleBinding	같은 namespace 안 user → Role
ClusterRoleBinding	cluster 전체 user → ClusterRole

ServiceAccount

apiVersion: v1
kind: ServiceAccount
metadata:
  name: app-sa
  namespace: default

• Pod 가 K8s API 호출 할 때의 identity.
• 기본은 default SA. 명시 권장.
• 모든 SA 는 토큰 자동 마운트 (/var/run/secrets/kubernetes.io/serviceaccount/token).

Role 예시

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: pod-reader
  namespace: default
rules:
  - apiGroups: [""]
    resources: [pods, pods/log]
    verbs: [get, list, watch]
  - apiGroups: [apps]
    resources: [deployments]
    verbs: [get, list]

verb	의미
get	단일
list	목록
watch	변경 stream
create	생성
update	갱신
patch	부분 갱신
delete	삭제
deletecollection	일괄 삭제

RoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app-pod-reader
  namespace: default
subjects:
  - kind: ServiceAccount
    name: app-sa
    namespace: default
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

ClusterRole + ClusterRoleBinding

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata: { name: namespace-admin }
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
---
kind: ClusterRoleBinding
metadata: { name: alice-cluster-admin }
subjects:
  - kind: User
    name: alice
roleRef:
  kind: ClusterRole
  name: namespace-admin

검사 / 디버깅

# 내가 무엇을 할 수 있나?
kubectl auth can-i get pods
kubectl auth can-i list secrets --as alice

# 특정 SA 권한
kubectl auth can-i get pods --as=system:serviceaccount:default:app-sa

# 누가 어떤 권한?
kubectl get rolebinding,clusterrolebinding -A | grep alice

Aggregated ClusterRole

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: monitoring
  labels:
    rbac.authorization.k8s.io/aggregate-to-monitoring: "true"
rules: [...]

다른 ClusterRole 이 자동 결합. 운영 도구의 plugin 권한 추가 패턴.

흔한 함정

관련 위키

• k8s-pod
• mtls
• OAuth2
• aws-iam (대조)