Unresolved Role reference in RoleBinding

RoleBinding grants Role permissions to Users or ServiceAccounts. This validator detects when a Role used in RoleBinding is not found.

Affected Resources: RoleBinding, ClusterRoleBinding

Examples

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods
subjects:
- kind: ServiceAccount
  name: backend
roleRef:
  kind: Role
  name: pod-reader                            # Role not found
  apiGroup: rbac.authorization.k8s.io

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: podreader                             # Name different
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]

Resolution

Check if the ClusterRole is present.

Check if the Role is present in the same namespace.

Check if the Role is present in a different namespace. Kubevious Search can be a very handy tool to find Roles across namespaces. You cannot mount a Role from a different namespaces. In that case you would need to create a Role in namespace where the RoleBinding resides.

Did you make a typo in the RoleBinding? Kubevious Search uses fuzzy logic to return results and can help with finding the correct Role.

Learn More

https://kubernetes.io/docs/reference/access-authn-authz/rbac/

ServiceAccount not specified in container

Unresolved Secret reference in ServiceAccount

Need other validation rules?

Please let us know if there are other built-in validation rules you would like to see in Kubevious to detect misconfigurations and violations to best practices. Optionally, you can provide your details so we can reach out to you with follow-up questions.

Share this article on: