0

For example I have a role that gives permission to user get list of pods from specific namespace. And I have a clusterRole that gives permission to user get list of pods from all namespaces.

can user get all pods from all namespaces? or does role override clusterRole because role is more specific?

I know this doesn't make sense. But what if I do it by mistake?

Murat Cabuk
  • 81
  • 7

2 Answers2

1

As per https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole

Permissions are purely additive (there are no "deny" rules).

That means you can't get less rights, only more if user is bound to multiple Roles or ClusterRoles

Andrew
  • 3,912
  • 17
  • 28
1

In kubernetes ClusterRole takes precedence over the Roles. Because the Role is bound to a certain namespace whereas the ClusterRole is a non-namespaced resource. Whenever a user requests for resources, the kubernetes will check the roles and clusterroles assigned to that user or service account.

If there is any conflict between Roles and ClusterRoles then the ClusterRole overrides the Role permissions for a user or service account in kubernetes.

For more detailed information refer to the Official RBAC Document

Dharani Dhar Golladasari
  • 632
  • 1
  • 9