🛡️ RBAC

RBAC (Role-Based Access Control) decides who can do what in the cluster. It combines three pieces:

Piece	Analogy	Example
Who (Service Account, User or Group)	The badge	app-sa
What (Role)	The list of allowed doors	leitor-pods
RoleBinding	Whoever hands the list to the badge	app-sa-leitor

The SaveinCloud cluster already comes with RBAC enabled: without an explicit permission, the answer is always denied.

info

RBAC is configured with kubectl. The Nuvion Panel does not have a screen for this feature.

---

🚀 Before you start

• Have cluster access configured (see Cluster Access).
• Have the Service Account app-sa (Service Accounts) and the Role leitor-pods (Roles). If you do not have them yet, create them quickly:

kubectl create serviceaccount app-sa
kubectl create role leitor-pods --verb=get,list,watch --resource=pods

🚀 1. Test before granting the permission

kubectl auth can-i list pods --as=system:serviceaccount:default:app-sa

Expected response: no

The kubectl auth can-i command asks the cluster whether an identity has a given permission. --as= runs the test on behalf of another identity.

🚀 2. Create the RoleBinding

kubectl create rolebinding app-sa-leitor --role=leitor-pods --serviceaccount=default:app-sa

Expected output: rolebinding.rbac.authorization.k8s.io/app-sa-leitor created

The default:app-sa format means namespace:service-account-name.

🚀 3. Test after the permission

kubectl auth can-i list pods --as=system:serviceaccount:default:app-sa
kubectl auth can-i delete pods --as=system:serviceaccount:default:app-sa
kubectl auth can-i list services --as=system:serviceaccount:default:app-sa

Expected responses, in order: yes, no, no. The Service Account can read pods, but cannot delete pods or read services.

🚀 4. See the RoleBinding

kubectl describe rolebinding app-sa-leitor

The output shows the Role (leitor-pods) and the Subject (app-sa).

🚀 5. Real proof inside a pod (optional)

Create the file pod-rbac.yaml:

apiVersion: v1
kind: Pod
metadata:
  name: pod-rbac
spec:
  serviceAccountName: app-sa
  containers:
    - name: curl
      image: curlimages/curl
      command: ["sleep", "3600"]

kubectl apply -f pod-rbac.yaml

When the pod is Running, request the pod list using the Service Account token:

kubectl exec pod-rbac -- sh -c 'curl -s --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://kubernetes.default.svc/api/v1/namespaces/default/pods | head -n 12'

The response is a JSON list (PodList). Now try to read services, which the Role does not allow:

kubectl exec pod-rbac -- sh -c 'curl -s --cacert /var/run/secrets/kubernetes.io/serviceaccount/ca.crt -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" https://kubernetes.default.svc/api/v1/namespaces/default/services'

The response contains "reason": "Forbidden", meaning access was denied.

🚀 6. Grant permission cluster-wide (ClusterRoleBinding)

To apply in all namespaces, use a ClusterRole with a ClusterRoleBinding:

kubectl create clusterrolebinding app-sa-leitor-geral --clusterrole=view --serviceaccount=default:app-sa

warning

Avoid granting cluster-admin. This role allows everything in the cluster, and whoever has it can read all Secrets and delete any resource.

✅ How to know it worked

Step 3 returns yes, no, no, and step 5 lists the pods but denies the services.

To see all permissions of an identity:

kubectl auth can-i --list --as=system:serviceaccount:default:app-sa

❗ Common problems

How to read a permission error message:

User "maria" cannot list resource "pods" in API group "" in the namespace "default"

It says who (maria), what was attempted (list), on which resource (pods) and where (default). A RoleBinding for that identity is missing.

Symptom	Cause	Solution
Forbidden even with a RoleBinding	RoleBinding in another namespace	Create it in the same namespace as the resource
can-i answers no	Wrong Service Account or Role name	Check with kubectl describe rolebinding
role "x" not found	Role does not exist	Create the Role before the RoleBinding

🧹 Cleanup

kubectl delete pod pod-rbac
kubectl delete rolebinding app-sa-leitor
kubectl delete clusterrolebinding app-sa-leitor-geral
kubectl delete role leitor-pods
kubectl delete clusterrole leitor-nodes
kubectl delete serviceaccount app-sa

➡️ Next step: Users

🧠 Questions?

Talk to our SaveinCloud technical support team!