--- title: The mechanics of Kubernetes RBAC and how it connects... description: A hands-on guide rebuilds Kubernetes RBAC authorization from first principles, explaining how identities (Users, ServiceAccounts, Groups) connect to... canonical: https://daily.dev/posts/the-mechanics-of-kubernetes-rbac-and-how-it-connects-users-to-permissions-moy3kdfl9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The mechanics of Kubernetes RBAC and how it connects users to permissions | daily.dev og:description: A hands-on guide rebuilds Kubernetes RBAC authorization from first principles, explaining how identities (Users, ServiceAccounts, Groups) connect to... og:url: https://daily.dev/posts/the-mechanics-of-kubernetes-rbac-and-how-it-connects-users-to-permissions-moy3kdfl9 og:image: https://api.daily.dev/og/posts/mOY3kdFl9.png og:image:alt: The mechanics of Kubernetes RBAC and how it connects users to permissions og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The mechanics of Kubernetes RBAC and how it connects users to permissions **[LearnKube](https://daily.dev/sources/learnkube)** · 30 min read · 0 upvotes · 0 comments ## Summary A hands-on guide rebuilds Kubernetes RBAC authorization from first principles, explaining how identities (Users, ServiceAccounts, Groups) connect to permissions through Roles, ClusterRoles, RoleBindings, and ClusterRoleBindings. It walks through four practical scenarios showing how bindings and roles interact across namespaces, covers custom resource API groups, cluster-scoped vs namespaced resources, concise rule notation, and how ServiceAccount tokens (projected short-lived tokens vs Secret-backed long-lived tokens) are used to authenticate against the API server. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can a RoleBinding reference a ClusterRole in Kubernetes, and what happens when it does? Yes, a RoleBinding can reference a ClusterRole instead of a Role. When it does, the ClusterRole's permissions for namespaced resources apply only to the namespace where the RoleBinding was created, effectively making the ClusterRole behave like a regular Role scoped to that single namespace, even though the ClusterRole itself is not namespaced. _Working through RBAC scoping quirks like this is easier with context gathered on daily.dev._ ### Can a ClusterRoleBinding reference a namespaced Role instead of a ClusterRole? No, a ClusterRoleBinding cannot reference a Role. Its roleRef field has no namespace attribute, and since Roles are namespaced while ClusterRoleBindings are not, there is no way to unambiguously identify which namespace's Role to use. ClusterRoleBindings can only bind ClusterRoles, and doing so grants those permissions cluster-wide across every namespace. _daily.dev helps developers keep this kind of RBAC nuance handy while designing cluster access._ ### What is the difference between a projected ServiceAccount token and a Secret-backed ServiceAccount token in Kubernetes? A projected ServiceAccount token is short-lived, requested via the TokenRequest API by the kubelet, and mounted into a Pod's volume with an expiration (for example 3607 seconds), refreshed automatically before it expires. A Secret-backed token, created by adding a kubernetes.io/service-account-token annotated Secret, is static and long-lived, and is not recommended for most workloads because it never rotates. _Developers weighing token lifetime tradeoffs for Kubernetes workloads can track such details on daily.dev._ ## Similar posts on daily.dev - [Medium](https://daily.dev/posts/medium-ppeofcz2x) · Medium · 0 upvotes · 0 comments - [Applying RBAC to databases on Kubernetes: Practical, real-world examples](https://daily.dev/posts/applying-rbac-to-databases-on-kubernetes-practical-real-world-examples-pwwhwtwkk) · CNCF · 0 upvotes · 0 comments - [How to Secure a Kubernetes Cluster: RBAC, Pod Hardening, and Runtime Protection](https://daily.dev/posts/how-to-secure-a-kubernetes-cluster-rbac-pod-hardening-and-runtime-protection-dbiccqree) · freeCodeCamp · 4 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#authorization](https://daily.dev/tags/authorization) [View this post on daily.dev](https://daily.dev/posts/the-mechanics-of-kubernetes-rbac-and-how-it-connects-users-to-permissions-moy3kdfl9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The mechanics of Kubernetes RBAC and how it connects users to permissions","url":"https://daily.dev/posts/the-mechanics-of-kubernetes-rbac-and-how-it-connects-users-to-permissions-moy3kdfl9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-mechanics-of-kubernetes-rbac-and-how-it-connects-users-to-permissions-moy3kdfl9"},"datePublished":"2026-08-31T11:20:04.673Z","dateModified":"2026-08-31T11:20:42.492Z","description":"A hands-on guide rebuilds Kubernetes RBAC authorization from first principles, explaining how identities (Users, ServiceAccounts, Groups) connect to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/90890191449668c847d13c8040f856e4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/90890191449668c847d13c8040f856e4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"LearnKube","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LearnKube","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/90786df1b5d44abb91a090a0b6c81517","url":"https://daily.dev/sources/learnkube"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-mechanics-of-kubernetes-rbac-and-how-it-connects-users-to-permissions-moy3kdfl9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,authorization","timeRequired":"PT30M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LearnKube","item":"https://daily.dev/sources/learnkube"},{"@type":"ListItem","position":3,"name":"The mechanics of Kubernetes RBAC and how it connects users to permissions"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-mechanics-of-kubernetes-rbac-and-how-it-connects-users-to-permissions-moy3kdfl9#faq","mainEntity":[{"@type":"Question","name":"Can a RoleBinding reference a ClusterRole in Kubernetes, and what happens when it does?","acceptedAnswer":{"@type":"Answer","text":"Yes, a RoleBinding can reference a ClusterRole instead of a Role. When it does, the ClusterRole's permissions for namespaced resources apply only to the namespace where the RoleBinding was created, effectively making the ClusterRole behave like a regular Role scoped to that single namespace, even though the ClusterRole itself is not namespaced. Working through RBAC scoping quirks like this is easier with context gathered on daily.dev."}},{"@type":"Question","name":"Can a ClusterRoleBinding reference a namespaced Role instead of a ClusterRole?","acceptedAnswer":{"@type":"Answer","text":"No, a ClusterRoleBinding cannot reference a Role. Its roleRef field has no namespace attribute, and since Roles are namespaced while ClusterRoleBindings are not, there is no way to unambiguously identify which namespace's Role to use. ClusterRoleBindings can only bind ClusterRoles, and doing so grants those permissions cluster-wide across every namespace. daily.dev helps developers keep this kind of RBAC nuance handy while designing cluster access."}},{"@type":"Question","name":"What is the difference between a projected ServiceAccount token and a Secret-backed ServiceAccount token in Kubernetes?","acceptedAnswer":{"@type":"Answer","text":"A projected ServiceAccount token is short-lived, requested via the TokenRequest API by the kubelet, and mounted into a Pod's volume with an expiration (for example 3607 seconds), refreshed automatically before it expires. A Secret-backed token, created by adding a kubernetes.io/service-account-token annotated Secret, is static and long-lived, and is not recommended for most workloads because it never rotates. Developers weighing token lifetime tradeoffs for Kubernetes workloads can track such details on daily.dev."}}]} ```