Q: A developer says they can't list pods in the `production` namespace but they can in `staging`. How do you debug this?
RBAC controls are namespace-scoped. Check:
#Kubernetes #RBAC & Security #L2 #Container Orchestration #K8s
🎙️ Candidate Opening & Architectural Context
""Kubernetes is a declarative desired state system; understanding the reconciliation loop is how you diagnose this quickly. When addressing this question, I walk the interviewer through our production incident runbook: isolating the blast radius, checking diagnostic logs and metrics, and applying a safe fix.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
RBAC controls are namespace-scoped. Check:
kubectl auth can-i list pods --namespace=production --as=— quick check.kubectl get rolebinding -n production— see what roles are bound in the production namespace.kubectl get clusterrolebinding | grep— check if there's a cluster-level binding.
2️⃣
Remediation & Permanent Safeguards
Fix: Create a RoleBinding in the production namespace giving the user the view or appropriate role:
kubectl create rolebinding dev-view --clusterrole=view --user=<username> -n production
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: kubectl auth can-i list pods --namespace=production --as= — quick check.."
⚡ 60-Second Elevator Pitch Talking Points
- kubectl auth can-i list pods --namespace=production --as= — quick check.
- kubectl get rolebinding -n production — see what roles are bound in the production namespace.
- kubectl get clusterrolebinding | grep — check if there's a cluster-level binding.
Advertisement