# Rbac Patterns

> ---

- Skill: `itsimonfredlingjack-codex-dev-plugin/rbac-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add itsimonfredlingjack-codex-dev-plugin/rbac-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/itsimonfredlingjack-codex-dev-plugin/rbac-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: itsimonfredlingjack (https://skillmd.com/u/itsimonfredlingjack-codex-dev-plugin)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/itsimonfredlingjack-codex-dev-plugin/rbac-patterns

---

---
name: rbac-patterns
description: Skill for rbac-patterns tasks.
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    spec:
      serviceAccountName: my-app
      automountServiceAccountToken: false # Disable if not needed
```

### Least-Privilege ServiceAccount

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-app-role
  namespace: production
rules:
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get"]
    resourceNames: ["my-app-config"]
```

## Security Best Practices

1. **Use Roles over ClusterRoles** when possible
2. **Specify resourceNames** for fine-grained access
3. **Avoid wildcard permissions** (`*`) in production
4. **Create dedicated ServiceAccounts** for each app
5. **Disable token auto-mounting** if not needed
6. **Regular RBAC audits** to remove unused permissions
7. **Use groups** for user management
8. **Implement namespace isolation**
9. **Monitor RBAC usage** with audit logs
10. **Document role purposes** in metadata

## Troubleshooting RBAC

### Check User Permissions

```bash
kubectl auth can-i list pods --as john@example.com
kubectl auth can-i '*' '*' --as system:serviceaccount:default:my-app
```

### View Effective Permissions

```bash
kubectl describe clusterrole cluster-admin
kubectl describe rolebinding -n production
```

### Debug Access Issues

```bash
kubectl get rolebindings,clusterrolebindings --all-namespaces -o wide | grep my-user
```

## Common RBAC Verbs

- `get` - Read a specific resource
- `list` - List all resources of a type
- `watch` - Watch for resource changes
- `create` - Create new resources
- `update` - Update existing resources
- `patch` - Partially update resources
- `delete` - Delete resources
- `deletecollection` - Delete multiple resources
- `*` - All verbs (avoid in production)

## Resource Scope

### Cluster-Scoped Resources

- Nodes
- PersistentVolumes
- ClusterRoles
- ClusterRoleBindings
- Namespaces

### Namespace-Scoped Resources

- Pods
- Services
- Deployments
- ConfigMaps
- Secrets
- Roles
- RoleBindings

## Output Format

```xml
<result>
  <analysis>Brief analysis</analysis>
  <solution>Implementation</solution>
  <considerations>Trade-offs and notes</considerations>
</result>
```