Advanced RBAC Patterns

Advanced RBAC Patterns

Complex organizations require sophisticated RBAC patterns beyond basic role assignments. Hierarchical permissions enable team leads to have elevated permissions while maintaining separation between teams. Aggregated ClusterRoles simplify permission management by composing roles from smaller components. These patterns reduce RBAC complexity while maintaining security.

ClusterRole aggregation uses label selectors to combine multiple ClusterRoles automatically. This enables creating modular permissions that combine into larger roles. For example, separate ClusterRoles for reading pods, services, and deployments can aggregate into a comprehensive viewer role. Changes to component roles automatically propagate to aggregated roles.

# Component ClusterRoles for aggregation
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pod-reader
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "pods/status"]
  verbs: ["get", "list", "watch"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployment-reader
  labels:
    rbac.authorization.k8s.io/aggregate-to-view: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
rules:
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets", "daemonsets", "statefulsets"]
  verbs: ["get", "list", "watch"]

---
# Aggregated viewer role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: namespace-viewer
aggregationRule:
  clusterRoleSelectors:
  - matchLabels:
      rbac.authorization.k8s.io/aggregate-to-view: "true"
rules: [] # Rules are automatically populated from matching ClusterRoles

---
# Multi-tenant RBAC with namespace isolation
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: tenant-admin
rules:
# Allow full control within tenant namespaces
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
  # Note: This is scoped by RoleBinding to specific namespaces

---
# Bind tenant-admin to namespace with naming convention
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tenant-admin-binding
  namespace: tenant-acme
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: tenant-admin
subjects:
- kind: Group
  name: acme-admins
  apiGroup: rbac.authorization.k8s.io

Dynamic RBAC management addresses environments where permissions change frequently. Rather than manually updating RoleBindings, operators can automatically manage RBAC based on labels, annotations, or external data sources. This automation reduces administrative overhead while maintaining security. However, automated RBAC requires careful validation to prevent permission escalation.