Kubernetes RBAC can feel confusing because the object names sound broader than the scope they actually grant.
A ClusterRole does not always mean cluster-wide access.
If you bind a ClusterRole with a RoleBinding, the permissions apply only in the namespace where the RoleBinding lives.
The article walks through:
- Why direct user-to-permission mappings do not scale
- how Roles and ClusterRoles group permissions into reusable sets
- how RoleBindings and ClusterRoleBindings connect identities to permissions
- How to test access with
kubectl auth can-iRead the full guide:
https://learnkube.com/rbac-kubernetes
