kubernetes
Kubernetes RBAC Generator
Generate a Kubernetes ServiceAccount, Role or ClusterRole, and RoleBinding or ClusterRoleBinding in one manifest. Configure resources and verbs for least-privilege access.
Kubernetes RBAC: Least-Privilege Access
RBAC (Role-Based Access Control) is how Kubernetes controls what users and workloads can do. Three resources work together: ServiceAccount, Role, and RoleBinding.
The Three-Resource Pattern
ServiceAccount — the identity (who)
Role — the permissions (what)
RoleBinding — links identity to permissions (who can do what)Common Permission Sets
Read-only (monitoring agents, dashboards):
``
verbs: [get, list, watch]
``
Read-write (operators, controllers):
``
verbs: [get, list, watch, create, update, patch, delete]
``
Checking Permissions
# What can this ServiceAccount do?
kubectl auth can-i --list \
--as=system:serviceaccount:default:my-app# Can it get pods? kubectl auth can-i get pods \ --as=system:serviceaccount:default:my-app ```
Common Pitfalls
- ›Using ClusterRole when Role is sufficient
- ›Using wildcard verbs/resources:
"*" - ›Binding to the default ServiceAccount (shared by all pods in namespace)
- ›Forgetting that RoleBinding scope determines access scope, not Role type
Key Terms
Full glossary →kubeadm
A tool for bootstrapping Kubernetes clusters. It automates the setup of control plane components and joining worker nodes, following Kubernetes best practices.
etcd
A distributed key-value store used by Kubernetes to store all cluster state and configuration. etcd is the single source of truth for the entire cluster.
cert-manager
A Kubernetes controller for automating TLS certificate management. cert-manager can issue certificates from Let's Encrypt, Vault, or internal CAs, and automatically renews them.
Helm
A package manager for Kubernetes. Helm charts bundle Kubernetes manifests into reusable packages with configurable values, versioned and published to chart repositories.
Frequently Asked Questions
What's the difference between Role and ClusterRole?
A Role grants access within a single namespace. A ClusterRole grants access cluster-wide — across all namespaces. Always prefer Role over ClusterRole unless you genuinely need cluster-wide access. A ClusterRole can also be bound to a specific namespace via a RoleBinding (not ClusterRoleBinding) — this is a common pattern for shared roles.
What API group should I use for Deployments?
Deployments, StatefulSets, DaemonSets, and ReplicaSets are in the 'apps' API group. Pods, Services, ConfigMaps, Secrets, PVCs are in the core group (empty string). CronJobs are in 'batch'. You can check with: kubectl api-resources --sort-by=group.
What is the principle of least privilege for RBAC?
Grant only the permissions the workload actually needs. Start with get,list,watch (read-only) and add write verbs only when required. Avoid wildcards (*) for both resources and verbs — they grant access to everything including future resource types. Audit RBAC with: kubectl auth can-i --list --as=system:serviceaccount:default:my-app.
How do I use the ServiceAccount in a Pod?
Set serviceAccountName in the pod spec. Kubernetes automatically mounts the token at /var/run/secrets/kubernetes.io/serviceaccount/token. In the pod: kubectl --token=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token) get pods. For security, set automountServiceAccountToken: false on pods that don't need API access.
Related Calculators
Related Generators
Related Comparisons
Related Guides
kubernetes
CI/CD for Kubernetes with GitHub Actions: A Complete Guide (2026)
A practical walkthrough of building a full GitHub Actions pipeline that builds a container image, pushes it to a registry, and deploys to Kubernetes — with secrets handling, rollback, and Helm support.
kubernetes
ArgoCD vs Flux: Choosing a GitOps Tool for Kubernetes in 2026
A no-fluff comparison of ArgoCD and Flux for GitOps on Kubernetes — covering architecture, UI, Helm support, multi-tenancy, and when to pick each one.
kubernetes
Hetzner vs DigitalOcean for Kubernetes in 2026: An Honest Comparison
Hetzner is 3–5× cheaper than DigitalOcean for equivalent Kubernetes compute. But DO has managed K8s, better global coverage, and a larger app marketplace. Here's when each is the right choice.