* [Topics](/en/topics "Topics") * [Containers](/en/topics/containers "Containers") * What is Kubernetes role-based access control (RBAC)? What is Kubernetes role-based access control (RBAC)? ==================================================== Published June 22, 2021•*2*-minute read Copy URL Jump to section --------------- OverviewWhat is Kubernetes?What are roles?How it worksWhy Red Hat? Overview -------- Kubernetes Role-Based Access Control (RBAC) is a form of identity and access management (IAM) that involves a set of permissions or template that determines who (subjects) can execute what (verbs), where (namespaces). [RBAC](/en/topics/security/what-is-role-based-access-control) is an evolution from the traditional attribute-based access control (ABAC)—which grants access based on user name rather than user responsibilities. [The state of Kubernetes security in 2024](/en/engage/state-kubernetes-security-report-2024) What is Kubernetes? ------------------- [Kubernetes](/en/topics/containers/what-is-kubernetes) (also known as k8s or kube) is an [open source](/en/topics/open-source/what-is-open-source-software) [container orchestration](/en/topics/containers/what-is-container-orchestration) platform that [automates](/en/topics/automation) many of the manual processes involved in [deploying](/en/topics/containers/what-is-kubernetes-deployment), [managing](/en/topics/management), and scaling containerized applications. When managed by Kubernetes, Linux containers give [microservice](/en/topics/microservices/what-are-microservices)-based apps an ideal application deployment unit and self-contained execution environment. And because Kubernetes deployments are written in [YAML](/en/topics/automation/what-is-yaml), the code is human-readable. [Learn more about Kubernetes](/en/topics/containers/what-is-kubernetes "article | what is kubernetes?") Red Hat resources ----------------- [Keep reading](/en/resources "Keep reading") What are roles? --------------- Roles grant various levels of access to [pods](/en/topics/containers/what-is-kubernetes-pod) and nodes. Roles can be authorized to access a specific group of [clusters](/en/topics/containers/what-is-a-kubernetes-cluster) working together as an application workload (known simply as as roles) or entire clusters (known as cluster roles). * **Roles** grant permission to virtually linked groups of clusters known as namespaces. Roles are a type of namespaced resource because user access to a workload is determined by what clusters are included in the specific namespace. Users, groups of users, or service account names can be consolidated into a single role through **role binding**. * **Cluster roles** grant permission to entire clusters, which are groups of individual hardware nodes. Cluster roles can span multiple namespaces. **Cluster role binding** ties a cluster role to every namespace in a cluster. For example, the cluster administrator cluster role name has unfettered access to all clusters. Role binding and cluster role permissions can be combined and stacked using metadata. This grants permissions defined in a cluster role to resources inside the role binding's namespace—helping define common roles across a cluster that can be reused across multiple namespaces. [Here are 5 common Kubernetes RBAC mistakes](https://cloud.redhat.com/blog/5-kubernetes-rbac-mistakes-you-must-avoid "5 Kubernetes RBAC Mistakes You Must Avoid") How does Kubernetes RBAC work? ------------------------------ The Kubernetes [application programming interface (API)](/en/topics/api) is the front end of the Kubernetes control plane. The [Kubernetes API](/en/topics/containers/what-is-the-kubernetes-api) communicates interactions with a computer or system to retrieve information or perform a [function](/en/topics/cloud-native-apps/what-is-faas). Kubernetes RBAC collects related function requests into API groups, which communicate with API servers when connecting certain roles to API endpoints. For more information on using Kubernetes RBAC—including Kubernetes documentation, rbac.authorization.k8s.io authentication, the kubectl command line tool, add-ons, kubelet TLS bootstrapping, and setting up network policies, visit [the open source project's RBAC docs](https://kubernetes.io/docs/reference/access-authn-authz/rbac/). Why Red Hat? ------------ Red Hat was one of the first companies to work with Kubernetes’ creator—Google—on the project even prior to launch. Since then, it has become the 2nd leading contributor to the Kubernetes upstream project and became one of the first to market with an enterprise Kubernetes platform. [Red Hat® OpenShift®](/en/technologies/cloud-computing/openshift) is Kubernetes for the enterprise, including all the extra pieces of technology that make Kubernetes more powerful and viable. These components include networking, authentication, monitoring, [security](/en/topics/security), and automation, among others. Unlike other vendor platforms that require proprietary components—as well as complex processes—Red Hat OpenShift is a single, integrated platform for operations and development teams, validating popular [storage](/en/topics/data-storage) and networking plug-ins for Kubernetes and including built-in monitoring, logging, and analytics solutions. [Keep reading](/en/topics/containers/why-choose-red-hat-kubernetes "article | Why choose Red Hat for Kubernetes?") Hub The official Red Hat blog ------------------------- Get the latest information about our ecosystem of customers, partners, and communities. [Keep reading](/en/blog "The official Red Hat blog") All Red Hat product trials -------------------------- Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization. [Keep reading](/en/products/trials "All Red Hat product trials") Keep reading ------------ ### What is a Linux container? Find out more about Linux containers, which are a set of 1 or more processes that are isolated from the rest of the system. [Read the article](/en/topics/containers/whats-a-linux-container "article | what is a linux container?") ### What is container orchestration? Container orchestration automates the deployment, management, scaling, and networking of containers. [Read the article](/en/topics/containers/what-is-container-orchestration "article | what is container orchestration?") ### What is Kubernetes? Kubernetes is a container orchestration platform that eliminates many manual processes involved in deploying and scaling containerized applications. [Read the article](/en/topics/containers/what-is-kubernetes "article | what is kubernetes?") Containers resources -------------------- ### Related content * Blog post [Red Hat Named a Leader in 2025 Gartner® Magic Quadrant™ for Container Management for the Third Consecutive Year](/en/blog/red-hat-named-leader-2025-container-management) * Blog post [Zero trust starts here: Validated patterns for confidential container deployment](/en/blog/validated-patterns-confidential-container-deployment) * Blog post [Deploy sensitive workloads with OpenShift confidential containers](/en/blog/deploy-sensitive-workloads-with-openshift-confidential-containers) * Blog post [Confidential containers on Microsoft Azure with Red Hat OpenShift Sandboxed Containers 1.10 and Red Hat Build of Trustee](/en/blog/confidential-containers-microsoft-azure-red-hat-openshift-sandboxed-containers-110-and-red-hat-build-trustee) ### Related articles * [What is a Linux container?](/en/topics/containers/whats-a-linux-container) * [What is container orchestration?](/en/topics/containers/what-is-container-orchestration) * [Stateful vs stateless applications](/en/topics/cloud-native-apps/stateful-vs-stateless) * [What is Kubernetes?](/en/topics/containers/what-is-kubernetes) * [Red Hat OpenShift on VMware](/en/technologies/cloud-computing/openshift/vmware) * [What is KubeVirt?](/en/topics/virtualization/what-is-kubevirt) * [Why use Red Hat Ansible Automation Platform with Red Hat OpenShift?](/en/technologies/cloud-computing/openshift/ansible-on-openshift) * [What is Podman Desktop?](/en/topics/containers/what-is-podman-desktop) * [What is Podman?](/en/topics/containers/what-is-podman) * [What is the Kubernetes Java client?](/en/topics/cloud-computing/what-is-kubernetes-java-client) * [What are hosted control planes?](/en/topics/containers/what-are-hosted-control-planes) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Red Hat OpenShift for developers](/en/technologies/cloud-computing/openshift/developers) * [Containers vs VMs](/en/topics/containers/containers-vs-vms) * [Edge computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/edge-computing) * [How Kubernetes can help AI/ML](/en/topics/cloud-computing/how-kubernetes-can-help-ai) * [What is Kubeflow?](/en/topics/cloud-computing/what-is-kubeflow) * [What are microservices?](/en/topics/microservices/what-are-microservices) * [What is container security?](/en/topics/security/container-security) * [OpenShift vs. OpenStack: What are the differences?](/en/technologies/cloud-computing/openshift/openshift-vs-openstack) * [What are sandboxed containers](/en/topics/containers/sandboxed-containers) * [What is Buildah?](/en/topics/containers/what-is-buildah) * [Kubernetes vs OpenStack](/en/topics/openstack/kubernetes-vs-openstack) * [What are validated patterns?](/en/topics/cloud-computing/what-are-validated-patterns) * [Kubernetes on AWS: Self-Managed vs. Managed Applications Platforms](/en/topics/containers/kubernetes-on-aws) * [What is an image builder?](/en/topics/linux/what-is-an-image-builder) * [Red Hat OpenShift vs. OKD](/en/topics/containers/red-hat-openshift-okd) * [Red Hat OpenShift vs. Kubernetes: What's the difference?](/en/technologies/cloud-computing/openshift/red-hat-openshift-kubernetes) * [What is high availability and disaster recovery for containers?](/en/topics/containers/high-availability-containers) * [Why run Apache Kafka on Kubernetes?](/en/topics/integration/why-run-apache-kafka-on-kubernetes) * [Spring on Kubernetes with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/spring) * [What is a golden image?](/en/topics/linux/what-is-a-golden-image) * [What are Red Hat OpenShift cloud services?](/en/technologies/cloud-computing/openshift/what-are-red-hat-openshift-cloud-services) * [VNF and CNF, what’s the difference?](/en/topics/cloud-native-apps/vnf-and-cnf-whats-the-difference) * [What is a container registry?](/en/topics/cloud-native-apps/what-is-a-container-registry) * [What is Skopeo?](/en/topics/containers/what-is-skopeo) * [What are Red Hat OpenShift Operators?](/en/technologies/cloud-computing/openshift/what-are-openshift-operators) * [Using Helm with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/helm) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Orchestrating Windows containers on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/windows-containers-on-red-hat-openshift) * [What is a Kubernetes operator?](/en/topics/containers/what-is-a-kubernetes-operator) * [High performance computing with Red Hat OpenShift](/en/technologies/cloud-computing/openshift/high-performance-computing) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [What is KubeLinter?](/en/topics/containers/what-is-kubelinter) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [How microservices support IT integration in healthcare](/en/topics/microservices/microservices-in-healthcare) * [Kubernetes cluster management](/en/technologies/cloud-computing/openshift/kubernetes-cluster-management) * [Red Hat OpenShift on IBM IT infrastructure](/en/technologies/cloud-computing/openshift/what-is-red-hat-openshift-on-IBM-IT-infrastructure) * [Red Hat OpenShift for business leaders](/en/technologies/cloud-computing/openshift/business-leaders) * [How to deploy Red Hat OpenShift](/en/technologies/cloud-computing/openshift/deploy-red-hat-openshift) * [Cost management for Kubernetes on Red Hat OpenShift](/en/technologies/cloud-computing/openshift/cost-management) * [What makes Red Hat OpenShift the right choice for IT operations?](/en/technologies/cloud-computing/openshift/it-operations) * [What makes Red Hat OpenShift the right choice for SAP?](/en/technologies/cloud-computing/openshift/sap) * [Why choose Red Hat for Kubernetes?](/en/topics/containers/why-choose-red-hat-kubernetes) * [Kubernetes-native Java development with Quarkus](/en/technologies/cloud-computing/openshift/quarkus) * [What is enterprise Kubernetes?](/en/topics/containers/what-is-enterprise-kubernetes) * [What is containerization?](/en/topics/cloud-native-apps/what-is-containerization) * [What was CoreOS and CoreOS container Linux](/en/technologies/cloud-computing/openshift/what-was-coreos) * [Learning Kubernetes basics](/en/topics/containers/learning-kubernetes-tutorial) * [What is service-oriented architecture?](/en/topics/cloud-native-apps/what-is-service-oriented-architecture) * [What is the Kubernetes API?](/en/topics/containers/what-is-the-kubernetes-api) * [What is Kubernetes cluster management?](/en/topics/containers/what-is-kubernetes-cluster-management) * [What is a Kubernetes deployment?](/en/topics/containers/what-is-kubernetes-deployment) * [Why choose the Red Hat build of Quarkus?](/en/topics/cloud-native-apps/why-choose-red-hat-quarkus) * [Introduction to Kubernetes architecture](/en/topics/containers/kubernetes-architecture) * [What is CaaS?](/en/topics/cloud-computing/what-is-caas) * [Introduction to Kubernetes patterns](/en/topics/cloud-native-apps/introduction-to-kubernetes-patterns) * [What is a Kubernetes cluster?](/en/topics/containers/what-is-a-kubernetes-cluster) * [What is Quarkus?](/en/topics/cloud-native-apps/what-is-quarkus) * [What is Jaeger?](/en/topics/microservices/what-is-jaeger) * [What is container-native virtualization?](/en/topics/containers/what-is-container-native-virtualization) * [What is Clair?](/en/topics/containers/what-is-clair) * [What is Knative?](/en/topics/microservices/what-is-knative) * [What is etcd?](/en/topics/containers/what-is-etcd) * [Why choose Red Hat for microservices?](/en/topics/microservices/why-choose-red-hat-microservices) * [Why choose Red Hat for containers?](/en/topics/containers/why-choose-red-hat-containers) * [What is Docker?](/en/topics/containers/what-is-docker) * [What is a Kubernetes pod?](/en/topics/containers/what-is-kubernetes-pod) [More about this topic](/en/topics/containers "More about this topic")