📋 Roles

A Role is a list of what is allowed to be done within a namespace. Example: "can read pods, but cannot delete". It defines the permissions, but does not hand them to anyone. That is done by RBAC (next page).

Type	Applies to	When to use
Role	One namespace	Most cases
ClusterRole	The entire cluster	Resources without a namespace (such as nodes) or permissions across all namespaces

Each rule combines what (resources, such as pods and services) with what to do (verbs):

Verb	Meaning
get, list, watch	Read
create	Create
update, patch	Modify
delete	Delete

info

Roles are created with kubectl. The Nuvion Panel does not have a screen for this feature.

---

🚀 Before you start

• Have cluster access configured.

🚀 1. See the permissions that already exist

kubectl get roles -A
kubectl get clusterrole view edit admin cluster-admin

The ClusterRoles view, edit, admin and cluster-admin come ready-made:

ClusterRole	What it allows
view	Read-only
edit	Read and modify most resources
admin	Full control within a namespace
cluster-admin	Full control of the entire cluster

🚀 2. Create a pod-reading Role

kubectl create role leitor-pods --verb=get,list,watch --resource=pods

Expected output: role.rbac.authorization.k8s.io/leitor-pods created

🚀 3. See the details

kubectl describe role leitor-pods

The table shows the resource (pods) and the allowed verbs (get, list, watch).

🚀 4. Understand the Role in YAML

The command from step 2 is equivalent to this file:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: leitor-pods
  namespace: default
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]

apiGroups: [""] (empty) indicates the core Kubernetes group, where pods, services, configmaps and secrets live.

🚀 5. Create a ClusterRole

Nodes do not belong to any namespace, so they need a ClusterRole:

kubectl create clusterrole leitor-nodes --verb=get,list,watch --resource=nodes

✅ How to know it worked

kubectl get role leitor-pods
kubectl get clusterrole leitor-nodes

Both appear in the list.

🔒 Best practices

• Grant only what is needed (least privilege).
• Avoid * in verbs and resources.
• Be even stricter with secrets, since allowing read is equivalent to handing out passwords.

❗ Common problems

Symptom	Cause	Solution
forbidden: ... cannot create resource "roles"	Your user cannot create Roles	Ask a cluster administrator
Error mentioning escalation or attempting to grant RBAC permissions not currently held	Kubernetes does not let you create a Role with permissions greater than your own	Use a user with more permissions
already exists	Name already in use	Use another name or delete the existing Role

🧹 Cleanup

Only clean up after completing the RBAC page, which uses the leitor-pods Role:

kubectl delete role leitor-pods
kubectl delete clusterrole leitor-nodes

➡️ Next step: RBAC

🧠 Questions?

Talk to our SaveinCloud technical support team!