In this lesson, you will learn how to define and manage the necessary ClusterRoles and RoleBindings to grant your Kubernetes Operator the precise permissions required to reconcile custom resources.
When you develop an Operator, it acts as a service account running inside your cluster. By default, this account has no permissions. Because an Operator must watch, create, and update resources—such as Deployments, Services, or your own custom CRDs—you must explicitly grant it access using Kubernetes Role-Based Access Control (RBAC).
Defining Permissions
Permissions are defined using ClusterRoles, which group sets of rules (API verbs like get, list, watch, create, update, patch, or delete) for specific resources. To provide these permissions, we typically use the //+kubebuilder:rbac markers in our Go controller files. These markers allow the Operator SDK to generate the necessary YAML manifests for us during the build process.
For example, if your controller needs to manage Deployments in a specific namespace, you would add this marker above your Reconcile function:
//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;watch;create;update;patch;delete
Granting Access via Bindings
Once the ClusterRole is defined, the Operator needs a RoleBinding (if scoped to a single namespace) or a ClusterRoleBinding (if global) to associate that role with the Operator's specific ServiceAccount.
When you deploy your Operator using the Operator Lifecycle Manager (OLM) or via a standard deployment manifest, the ServiceAccount referenced in your binding must match the one used by your Operator Pod. If your Operator attempts to perform an action (like scaling a deployment) without the corresponding verb in its Role, the Kubernetes API server will reject the request with a 403 Forbidden error, and your reconciliation loop will fail.
Always follow the principle of least privilege: only grant the specific verbs and resources required by your reconciliation logic. Avoid using wildcard permissions (*) to ensure your infrastructure remains secure and predictable.
Key Takeaway: Use RBAC markers to define the minimum set of API verbs and resources required for your controller to function, ensuring your Operator has exactly the power it needs—and nothing more.