ClusterRoles

ClusterRoles define permissions that are not tied to one namespace.

They are needed for cluster-scoped resources, such as nodes, namespaces, persistent volumes, and custom resource definitions. They can also define reusable permission sets that are later bound inside a namespace with a RoleBinding.

ClusterRole vs Role

Use a Role for namespaced access:

Role + RoleBinding -> access inside one namespace

Use a ClusterRole for cluster-scoped resources or reusable rules:

ClusterRole + RoleBinding -> access inside one namespace
ClusterRole + ClusterRoleBinding -> access across the cluster

That distinction is important. A ClusterRole is not automatically granted everywhere. The binding decides where it applies.

Reuse A ClusterRole In One Namespace

Kubernetes includes built-in ClusterRoles such as view, edit, and admin.

Create a service account:

kubectl create serviceaccount namespace-viewer --namespace=lab

Bind the built-in view ClusterRole only in the lab namespace:

kubectl create rolebinding namespace-viewer-binding \
  --clusterrole=view \
  --serviceaccount=lab:namespace-viewer \
  --namespace=lab

Check access in lab:

kubectl auth can-i list pods \
  --as system:serviceaccount:lab:namespace-viewer \
  --namespace=lab

Expected output:

yes

Check access in default:

kubectl auth can-i list pods \
  --as system:serviceaccount:lab:namespace-viewer \
  --namespace=default

Expected output:

no

Cluster-Wide Binding

A ClusterRoleBinding applies across the cluster:

kubectl create clusterrolebinding namespace-viewer-cluster-wide \
  --clusterrole=view \
  --serviceaccount=lab:namespace-viewer

Now that service account can view resources in every namespace where the view role grants access.

Delete the cluster-wide binding after testing:

kubectl delete clusterrolebinding namespace-viewer-cluster-wide

Clean Up

kubectl delete rolebinding namespace-viewer-binding --namespace=lab
kubectl delete serviceaccount namespace-viewer --namespace=lab

Practical Guidance

Use ClusterRoles carefully:

1. Use ClusterRoleBindings only when access must be cluster-wide.
2. Prefer RoleBindings when reusing a ClusterRole inside one namespace.
3. Review built-in roles before using them; view, edit, and admin are broad.
4. Treat access to nodes, namespaces, CRDs, admission resources, and RBAC resources as sensitive.
5. Avoid binding service accounts to cluster-admin except for tightly controlled platform components.