Cluster Roles/Bindings and RBAC Integration in Kubernetes

3rd chunk of `content/en/blog/_posts/2017-04-00-Rbac-Support-In-Kubernetes.md`

9a0599d3c629129c3e5466633efdf0dab9fb59893b60741900000001000006de

![](https://1.bp.blogspot.com/-ixDe91-cnqw/WOa0auxC0mI/AAAAAAAABBs/4LxVsr6shEgTYqUapt5QPISUeuTuztVwwCEw/s640/rbac2.png)](https://1.bp.blogspot.com/-ixDe91-cnqw/WOa0auxC0mI/AAAAAAAABBs/4LxVsr6shEgTYqUapt5QPISUeuTuztVwwCEw/s1600/rbac2.png)  


Additionally there are cluster roles and cluster role bindings to consider. Cluster roles and cluster role bindings function like roles and role bindings except they have wider scope. The exact differences and how cluster roles and cluster role bindings interact with roles and role bindings are covered in the [Kubernetes documentation](/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding).  

**RBAC in Kubernetes**  

RBAC is now deeply integrated into Kubernetes and used by the system components to grant the permissions necessary for them to function. [System roles](/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings) are typically prefixed with system: so they can be easily recognized.  


 ```
➜  kubectl get clusterroles --namespace=kube-system

NAME                    KIND

admin ClusterRole.v1beta1.rbac.authorization.k8s.io

cluster-admin ClusterRole.v1beta1.rbac.authorization.k8s.io

edit ClusterRole.v1beta1.rbac.authorization.k8s.io

kubelet-api-admin ClusterRole.v1beta1.rbac.authorization.k8s.io

system:auth-delegator ClusterRole.v1beta1.rbac.authorization.k8s.io

system:basic-user ClusterRole.v1beta1.rbac.authorization.k8s.io

system:controller:attachdetach-controller ClusterRole.v1beta1.rbac.authorization.k8s.io

system:controller:certificate-controller ClusterRole.v1beta1.rbac.authorization.k8s.io

...
  ```


The RBAC system roles have been expanded to cover the necessary permissions for running a Kubernetes cluster with RBAC only.

Title: Cluster Roles/Bindings and RBAC Integration in Kubernetes

Summary

Cluster roles and cluster role bindings have a wider scope than their non-cluster counterparts. RBAC is deeply integrated into Kubernetes, with system components using it for necessary permissions. System roles, typically prefixed with 'system:', have been expanded to cover all permissions required for running a Kubernetes cluster solely with RBAC.