Lab Solution Cluster Roles

This lesson walks through ClusterRoles and ClusterRoleBindings: how to inspect what’s already in the cluster, examine who has cluster-admin privileges, and create ClusterRoles and ClusterRoleBindings to grant a user (michelle) access to cluster-scoped resources (nodes and storage).

Inspect existing ClusterRoles

Count all ClusterRoles in the cluster:

kubectl get clusterroles --no-headers | wc -l

Example output (your environment will vary; this environment shows 69):

ClusterRoles are cluster-scoped (not namespaced). To list them:

kubectl get clusterroles

You will see many system roles, for example cluster-admin, controller roles, and add-on roles such as system:coredns or local-path-provisioner-role.

Inspect existing ClusterRoleBindings

Count ClusterRoleBindings:

kubectl get clusterrolebindings --no-headers | wc -l

Example output in this environment:

ClusterRoleBindings are cluster-scoped as well.

ClusterRoles and ClusterRoleBindings are cluster-scoped objects — they do not belong to any namespace.

Check who has cluster-admin

Find ClusterRoleBindings that reference the cluster-admin ClusterRole:

kubectl get clusterrolebindings | grep cluster-admin

Example output:

cluster-admin                          12m   ClusterRole/cluster-admin
helm-kube-system-traefik               12m   ClusterRole/cluster-admin
helm-kube-system-traefik-crd           12m   ClusterRole/cluster-admin

Describe the cluster-admin ClusterRoleBinding to view its subjects:

kubectl describe clusterrolebinding cluster-admin

Example output (shows the system:masters group is bound):

Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind   Name           Namespace
  ----   ----           ---------
  Group  system:masters

Inspect the cluster-admin ClusterRole to see the full privileges it grants:

kubectl describe clusterrole cluster-admin

Example output:

Name:	cluster-admin
Labels:	kubernetes.io/bootstrapping=rbac-defaults
Annotations:	rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources           Non-Resource URLs   Resource Names   Verbs
  --------           -----------------   --------------   -----
  *.*                 []                  []               [*]
  []                  [*]                 []               [*]

This shows cluster-admin grants full access across all resources and non-resource URLs.

The cluster-admin role provides full cluster-wide privileges. Bind it only to trusted users or service accounts.

Task: Grant Michelle access to nodes

Michelle currently cannot list nodes. To see the error when attempting to list nodes as michelle:

kubectl get nodes --as=michelle

Example error:

Error from server (Forbidden): nodes is forbidden: User "michelle" cannot list resource "nodes" in API group "" at the cluster scope

To grant Michelle read-only access to nodes (list/get/watch), create a ClusterRole and bind it to her: Create the ClusterRole:

kubectl create clusterrole michelle-role --verb=get,list,watch --resource=nodes

Create the ClusterRoleBinding that ties the role to the user michelle:

kubectl create clusterrolebinding michelle-role-binding --clusterrole=michelle-role --user=michelle

Verify the ClusterRole:

kubectl describe clusterrole michelle-role

Example output:

Name:        michelle-role
Labels:      <none>
Annotations: <none>
PolicyRule:
  Resources   Non-Resource URLs   Resource Names   Verbs
  --------    -----------------   --------------   -----
  nodes       []                  []               [get list watch]

Verify the ClusterRoleBinding:

kubectl describe clusterrolebinding michelle-role-binding

Example output:

Name:        michelle-role-binding
Labels:      <none>
Annotations: <none>
Role:
  Kind:  ClusterRole
  Name:  michelle-role
Subjects:
  Kind   Name      Namespace
  -----  ----      -------
  User   michelle

Test the permission as Michelle:

kubectl get nodes --as=michelle

Example successful output:

NAME           STATUS   ROLES                   AGE   VERSION
controlplane   Ready    control-plane,master    16m   v1.23.3+k3s1

Task: Grant Michelle access to storage (PersistentVolumes and StorageClasses)

Michelle now needs permissions for storage resources. Use kubectl api-resources to determine resource names, short names, API groups, and whether a resource is namespaced:

kubectl api-resources

Relevant cluster-scoped storage resources include:

Resource	Short name	apiGroup / apiVersion	Namespaced?
persistentvolumes	`pv`	`v1` (core)	No
storageclasses	`sc`	`storage.k8s.io/v1`	No

Create a ClusterRole that allows Michelle to list, create, get, and watch PersistentVolumes and StorageClasses:

kubectl create clusterrole storage-admin --resource=persistentvolumes,storageclasses.storage.k8s.io --verb=list,create,get,watch

Describe the new ClusterRole:

kubectl describe clusterrole storage-admin

Example output:

Name:        storage-admin
Labels:      <none>
Annotations: <none>
PolicyRule:
  Resources                         Non-Resource URLs  Resource Names  Verbs
  ---------                         -----------------  --------------  -----
  persistentvolumes                 []                 []               [list create get watch]
  storageclasses.storage.k8s.io     []                 []               [list create get watch]

You can also view the ClusterRole YAML:

kubectl get clusterrole storage-admin -o yaml

Example YAML output:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: "2022-04-18T00:20:48Z"
  name: storage-admin
  resourceVersion: "921"
  uid: e0ee52a7-b32c-4a42-b8b7-a783b040cd4e
rules:
- apiGroups:
  - ""
  resources:
  - persistentvolumes
  verbs:
  - list
  - create
  - get
  - watch
- apiGroups:
  - storage.k8s.io
  resources:
  - storageclasses
  verbs:
  - list
  - create
  - get
  - watch

Bind the storage-admin ClusterRole to Michelle:

kubectl create clusterrolebinding michelle-storage-binding --clusterrole=storage-admin --user=michelle

Verify Michelle can list storage classes (or persistent volumes) by running as Michelle:

kubectl get storageclasses --as=michelle
# or short name:
kubectl get sc --as=michelle

If the binding is configured correctly, Michelle will be able to list StorageClasses and PersistentVolumes.

Quick reference: Useful kubectl commands

Purpose	Command
Count ClusterRoles	`kubectl get clusterroles --no-headers \| wc -l`
List ClusterRoleBindings	`kubectl get clusterrolebindings`
Inspect a ClusterRoleBinding	`kubectl describe clusterrolebinding <name>`
Inspect a ClusterRole	`kubectl describe clusterrole <name>`
Show API resources	`kubectl api-resources`
Test permissions as a user	`kubectl get <resource> --as=<username>`

Summary

ClusterRoles and ClusterRoleBindings are cluster-scoped RBAC objects.
cluster-admin grants full cluster privileges and is typically bound to system:masters.
To grant a user access to cluster-scoped resources (nodes, PVs, StorageClasses), create a ClusterRole with the necessary verbs and resources, then create a ClusterRoleBinding to associate the role with the user (or group or service account).
Use kubectl api-resources to discover resource names, shortnames, API groups, and whether a resource is namespaced.

Links and references

Kubernetes RBAC: https://kubernetes.io/docs/reference/access-authn-authz/rbac/
kubectl reference: https://kubernetes.io/docs/reference/kubectl/overview/
kubectl api-resources: https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#api-resources

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

Lab Solution Cluster Roles

Inspect existing ClusterRoles

Inspect existing ClusterRoleBindings

Check who has cluster-admin

Task: Grant Michelle access to nodes

Task: Grant Michelle access to storage (PersistentVolumes and StorageClasses)

Quick reference: Useful kubectl commands

Summary

Links and references

Watch Video

​Inspect existing ClusterRoles

​Inspect existing ClusterRoleBindings

​Check who has cluster-admin

​Task: Grant Michelle access to nodes

​Task: Grant Michelle access to storage (PersistentVolumes and StorageClasses)

​Quick reference: Useful kubectl commands

​Summary

​Links and references

Watch Video

Inspect existing ClusterRoles

Inspect existing ClusterRoleBindings

Check who has cluster-admin

Task: Grant Michelle access to nodes

Task: Grant Michelle access to storage (PersistentVolumes and StorageClasses)

Quick reference: Useful kubectl commands

Summary

Links and references