LEARN. PRACTICE. GROW.Concept and mechanism
RBAC associates verbs and resources with identities through bindings. A Role is namespaced; a ClusterRole can describe reusable or cluster-scoped permissions. A RoleBinding in a namespace can reference a ClusterRole and grant namespaced permissions there. A ClusterRoleBinding broadens that grant to cluster scope. Select the ServiceAccount and its namespace correctly and validate the required operation without granting cluster-admin as a shortcut. Additive permissions should be reviewed through effective grants, including existing bindings, not just the new YAML file.
Guided application
Helm can render templates with values before installing a release. Review output for images, permissions, and resources without assuming local rendering proves target API support. Kustomize composes a base with explicit overlay differences, supporting per-environment configuration review. For extensions, a CRD registers a resource type; a controller implements the reconciliation giving it operational behavior. An operator includes logic that needs to run with suitable permissions and dependencies. If an object exists but nothing happens, inspect the controller and its state before changing resources without diagnosis.
Compare helm template ensaio./chart -f values-test.yaml with kubectl kustomize./overlays/test. Both support manifest review; neither command as written installs the workload into the cluster.
Common pitfalls
Using ClusterRoleBinding for a local task; editing the base for every environment; confusing a CRD with a running operator.
Related topics: Workloads, configuration, and scheduling · Services, policies, and names
Review who may act, which objects will be created, and which controller will implement behavior.
Reference: Kubernetes RBAC · CKA Kubernetes v1.35