RBAC controls who can perform which actions on which resources. Roles/ClusterRoles define permissions; RoleBindings/ClusterRoleBindings grant those to users, groups, or service accounts (namespaced or cluster-wide).

Detailed Answer

Roles are namespaced, ClusterRoles are cluster-scoped, and RBAC is purely additive (there are no deny rules). Best practice is least privilege: give each workload a dedicated ServiceAccount with only the verbs/resources it needs, avoid binding cluster-admin, and audit bindings regularly to limit blast radius if a token leaks.

💡

Interview Tip

Emphasize additive-only (no deny), namespaced vs cluster scope, and per-workload service accounts with least privilege.

kubernetesrbacsecurity

New to Kubernetes? Start with the Kubernetes: Getting Started guide.

Read the tutorial →

Explain RBAC in Kubernetes.

More Kubernetes questions