File contents ---
name: rbac-patterns
description: Skill for rbac-patterns tasks.
apiVersion: apps/v1
kind: Deployment
metadata:
name: my-app
spec:
template:
spec:
serviceAccountName: my-app
automountServiceAccountToken: false # Disable if not needed
### Least-Privilege ServiceAccount
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: my-app-role
namespace: production
rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
resourceNames: ["my-app-config"]
Security Best Practices
Use Roles over ClusterRoles when possibleSpecify resourceNames for fine-grained accessAvoid wildcard permissions (*) in productionCreate dedicated ServiceAccounts for each appDisable token auto-mounting if not neededRegular RBAC audits to remove unused permissionsUse groups for user managementImplement namespace isolation Monitor RBAC usage with audit logsDocument role purposes in metadata
Troubleshooting RBAC
Check User Permissions
kubectl auth can-i list pods --as john@example.com
kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-app
View Effective Permissions
kubectl describe clusterrole cluster-admin
kubectl describe rolebinding -n production
Debug Access Issues
kubectl get rolebindings,clusterrolebindings --all-namespaces -o wide | grep my-user
Common RBAC Verbs
get - Read a specific resourcelist - List all resources of a typewatch - Watch for resource changescreate - Create new resourcesupdate - Update existing resourcespatch - Partially update resourcesdelete - Delete resourcesdeletecollection - Delete multiple resources* - All verbs (avoid in production)
Resource Scope
Cluster-Scoped Resources
Nodes
PersistentVolumes
ClusterRoles
ClusterRoleBindings
Namespaces
Namespace-Scoped Resources
Pods
Services
Deployments
ConfigMaps
Secrets
Roles
RoleBindings
Output Format
<result>
<analysis>Brief analysis</analysis>
<solution>Implementation</solution>
<considerations>Trade-offs and notes</considerations>
</result>
1 --- 2 name: rbac-patterns 3 description: --- 4 --- 5 --- 6 name: rbac-patterns 7 description: Skill for rbac-patterns tasks. 8 --- 9 apiVersion: apps/v1 10 kind: Deployment 11 metadata: 12 name: my-app 13 spec: 14 template: 15 spec: 16 serviceAccountName: my-app 17 automountServiceAccountToken: false # Disable if not needed 18 ``` 19 20 ### Least-Privilege ServiceAccount 21 22 ```yaml 23 apiVersion: rbac.authorization.k8s.io/v1 24 kind: Role 25 metadata: 26 name: my-app-role 27 namespace: production 28 rules: 29 - apiGroups: [""] 30 resources: ["configmaps"] 31 verbs: ["get"] 32 resourceNames: ["my-app-config"] 33 ``` 34 35 ## Security Best Practices 36 37 1. **Use Roles over ClusterRoles** when possible 38 2. **Specify resourceNames** for fine-grained access 39 3. **Avoid wildcard permissions** (`*`) in production 40 4. **Create dedicated ServiceAccounts** for each app 41 5. **Disable token auto-mounting** if not needed 42 6. **Regular RBAC audits** to remove unused permissions 43 7. **Use groups** for user management 44 8. **Implement namespace isolation** 45 9. **Monitor RBAC usage** with audit logs 46 10. **Document role purposes** in metadata 47 48 ## Troubleshooting RBAC 49 50 ### Check User Permissions 51 52 ```bash 53 kubectl auth can-i list pods --as john@example.com 54 kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-app 55 ``` 56 57 ### View Effective Permissions 58 59 ```bash 60 kubectl describe clusterrole cluster-admin 61 kubectl describe rolebinding -n production 62 ``` 63 64 ### Debug Access Issues 65 66 ```bash 67 kubectl get rolebindings,clusterrolebindings --all-namespaces -o wide | grep my-user 68 ``` 69 70 ## Common RBAC Verbs 71 72 - `get` - Read a specific resource 73 - `list` - List all resources of a type 74 - `watch` - Watch for resource changes 75 - `create` - Create new resources 76 - `update` - Update existing resources 77 - `patch` - Partially update resources 78 - `delete` - Delete resources 79 - `deletecollection` - Delete multiple resources 80 - `*` - All verbs (avoid in production) 81 82 ## Resource Scope 83 84 ### Cluster-Scoped Resources 85 86 - Nodes 87 - PersistentVolumes 88 - ClusterRoles 89 - ClusterRoleBindings 90 - Namespaces 91 92 ### Namespace-Scoped Resources 93 94 - Pods 95 - Services 96 - Deployments 97 - ConfigMaps 98 - Secrets 99 - Roles 100 - RoleBindings 101 102 ## Output Format 103 104 ```xml 105 <result> 106 <analysis>Brief analysis</analysis> 107 <solution>Implementation</solution> 108 <considerations>Trade-offs and notes</considerations> 109 </result> 110 ```
commit 13dd7a04ad
Frequently asked questions How do I install the Rbac Patterns skill? Run npx skillmds@latest add itsimonfredlingjack-codex-dev-plugin/rbac-patterns in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
What does the Rbac Patterns skill do? --- It is listed under Coding & Dev Tools on SkillMD.
Is Rbac Patterns safe to use? This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
Which AI agents work with Rbac Patterns? This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Is Rbac Patterns free to use? Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
Who published Rbac Patterns? itsimonfredlingjack (@itsimonfredlingjack-codex-dev-plugin) published this skill. Their other Agent Skills are listed on their SkillMD profile.
itsimonfredlingjack