K
Q

What happens when multiple cluster roles are assigned to one service account in kubernetes?

7/15/2020

I know that you can assign multiple roles to one service account when you want your service account to access multiple namespaces, but what I wonder is how it will behave when you assign to it more than one clusterrole which is cluster scoped. From my perspective, I think that it will choose one of them but I'm not sure.

-- touati ahmed
kubernetes
rbac

Similar Questions

Helm: Is it wise to commit the .helm folder to source control?
Istio gives 404 NR response when it should be giving 200
Ansible run “kubectl apply kube-flannel.yml" not work
Kops kubenet cluster autoscaling not working
Kafka on Kubernetes under containerd, liveness probe fails

2 Answers

7/15/2020

Permissions are purely additive (there are no "deny" rules).

reference

This is the golden 🥇 rule here that we must memorize for kubernetes RBAC roles.

"purely additive" means always ALLOW no revoke.

Hence, "purely additive" means there are neither conflicts nor order of precedence.

  • It's not like AWS IAM policies where we have DENY and ALLOW .. That's time, we have to know which one has the highest order of precedence.
  • It's not like also subnets ACL , where we have DENY and ALLOW .. That's time, we need to assign number for each rule. This number will decide the order of precedence.

Example: 

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: node-reader
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "watch", "list"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: pod-reader
subjects:
- kind: User
  name: abdennour
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: node-reader
subjects:
- kind: User
  name: abdennour
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: node-reader
  apiGroup: rbac.authorization.k8s.io

as you can see in this example, the user Abdennour should have at the end the wide read access for both: nodes & pods.

-- Abdennour TOUMI
Source: StackOverflow
7/15/2020

If you assign a service account multiple clusterroles using multiple role or clusterrole bindings the service account will have permission which is aggregate of all of those cluster roles meaning all the verbs on all the resources defined in those clusterroles.

-- Arghya Sadhu
Source: StackOverflow