Kubernetes RBAC Viewer & Role Builder
Visualize Kubernetes Role and ClusterRole permissions as a security matrix or build least-privilege RBAC YAML safely in your browser.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: app-operator
namespace: production
rules:
- apiGroups:
- ""
resources:
- "pods"
- "pods/log"
verbs:
- "get"
- "list"
- "watch"
- apiGroups:
- "apps"
resources:
- "deployments"
verbs:
- "get"
- "list"
- "watch"
- "update"apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: app-operator-binding
namespace: production
subjects:
- kind: ServiceAccount
name: operator-sa
namespace: production
roleRef:
kind: Role
name: app-operator
apiGroup: rbac.authorization.k8s.ioDo it offline:$
How to use it
- Choose your RBAC scope: Namespace-Scoped (Role / RoleBinding) or Cluster-Wide (ClusterRole / ClusterRoleBinding).
- Define role name and target namespace (for namespace-scoped permissions).
- Configure API access rules specifying apiGroups ("" for core), target resources (pods, deployments), and allowed verbs (get, list, watch, create, update, delete).
- Review proactive security linting warnings (alerting on wildcard verbs, wildcard resources, or sensitive secrets access).
- Copy the generated YAML manifests directly into your deployment pipeline.
Design, visualize, and generate Kubernetes Role, ClusterRole, and RoleBinding manifests with automated least-privilege security analysis and wildcard warning detection.
How it works
Kubernetes Role-Based Access Control (RBAC) regulates user and service account access to cluster resources using declarative API rules.
A Role applies exclusively within a single namespace, whereas a ClusterRole grants permissions across all namespaces or non-namespaced cluster objects (like nodes and PVs).
RoleBinding binds a Role or ClusterRole to subjects (ServiceAccounts, Users, or Groups) within a specific namespace. ClusterRoleBinding binds a ClusterRole cluster-wide.
Manifests are generated locally in your browser with zero remote cluster connectivity required.
Examples
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
Common errors
FAQ
Can a RoleBinding reference a ClusterRole?
Yes! Binding a ClusterRole via a namespace-scoped RoleBinding grants the permissions defined in the ClusterRole strictly within that specific namespace. This enables defining reusable common roles (like 'admin' or 'viewer') across many namespaces.
Why does the tool warn against granting 'get' or 'list' on 'secrets'?
Access to secrets often enables privilege escalation. Pods or service accounts with read access to secrets can retrieve cluster admin tokens, TLS keys, or database credentials.
What is the difference between apiGroups [""] and ["apps"]?
The empty string [""] represents the core Kubernetes API group (Pods, Services, ConfigMaps, Secrets, PersistentVolumeClaims). Group ["apps"] contains Deployments, DaemonSets, and StatefulSets.