Managing Permissions in OpenShift: RBAC Best Practices

Introduction

OpenShift uses RBAC (Role-Based Access Control) to define who can access what within a cluster. By assigning roles to users and service accounts, administrators ensure least-privilege access and compliance with organizational policies.

🔑 RBAC Core Concepts

• Role: Defines permissions within a namespace.

• ClusterRole: Defines permissions across the entire cluster.

• RoleBinding: Assigns a Role to a user or service account.

• ClusterRoleBinding: Assigns a ClusterRole cluster-wide.

🛠️ Example: Creating a Role

yaml

kind: Role

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  namespace: dev

  name: pod-reader

rules:

- apiGroups: [""]

  resources: ["pods"]

  verbs: ["get", "list"]

🔗 Binding the Role

yaml

kind: RoleBinding

apiVersion: rbac.authorization.k8s.io/v1

metadata:

  name: read-pods

  namespace: dev

subjects:

- kind: User

  name: developer1

roleRef:

  kind: Role

  name: pod-reader

  apiGroup: rbac.authorization.k8s.io

🧪 Troubleshooting Tips

• Use oc auth can-i <verb> <resource> to test permissions.

• Check bindings with oc get rolebindings -n <namespace>.

• Audit cluster roles regularly to avoid privilege creep.

✅ Best Practices

• Apply least privilege principle.

• Use service accounts for automation instead of user accounts.

• Regularly review and prune unused roles.

• Separate developer and admin roles clearly.

Visit RSH Network for more information 👉 https://rshnetwork.com/