Which Kubernetes object is used to grant permissions to a cluster-wide resource?

In Kubernetes Role-Based Access Control (RBAC), a ClusterRoleBinding is used to grant permissions to subjects (users, groups, or service accounts) on a cluster-wide scope. It binds a ClusterRole, which defines permissions on cluster-scoped resources (like nodes) or on namespaced resources across all namespaces, to the specified subjects. This allows for the administration of resources that are not confined to a single namespace.

A. RoleBinding: A RoleBinding grants permissions only within a specific namespace; it cannot be used for cluster-wide resources.

C. RoleReference: This is not a standalone Kubernetes object. It is a field within a RoleBinding or ClusterRoleBinding that refers to the Role or ClusterRole being granted.

D. ClusterRoleAccess: This is not a valid or recognized Kubernetes API object.

---

1. Kubernetes Official Documentation

"Using RBAC Authorization": This document explicitly defines the four kinds of RBAC objects. It states

"A ClusterRoleBinding grants permissions cluster-wide."

Reference: Kubernetes Authors. (n.d.). Using RBAC Authorization. Kubernetes Documentation. Retrieved from https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding. See the section "RoleBinding and ClusterRoleBinding".

2. VMware vSphere with Tanzu Documentation: The documentation for managing Tanzu Kubernetes clusters explains the use of standard Kubernetes RBAC objects. It describes how ClusterRoleBinding is used to grant cluster-level permissions.

Reference: VMware. (2023). Managing User Permissions on a Tanzu Kubernetes Cluster by Applying a Role Binding. VMware vSphere Documentation. In the context of granting cluster-admin roles

the use of ClusterRoleBinding is detailed. See the section on "Privileges for vSphere with Tanzu".

3. Red Hat OpenShift Documentation (Based on Kubernetes): As a Kubernetes distribution

its documentation provides clear examples. "A cluster role binding grants a user

group

or service account a cluster role to use across all projects in the cluster."

Reference: Red Hat. (n.d.). Using RBAC to define and apply permissions. OpenShift Container Platform 4.10 Documentation. Retrieved from https://docs.openshift.com/container-platform/4.10/authentication/using-rbac.html. See the section "Cluster role bindings".