WEBVTT 00:00.790 --> 00:04.960 We discussed about roles and role bindings in the previous lecture. 00:05.140 --> 00:12.040 In this lecture we will talk about cluster roles and cluster roles bindings when we talked about roles 00:12.040 --> 00:12.970 and role bindings. 00:12.970 --> 00:20.930 We said that roles and role bindings are namespaced meaning they are created within namespaces. 00:20.980 --> 00:27.520 If you don't specify in namespace they're created in the default namespace and control access within 00:27.520 --> 00:34.740 that namespace alone in one of the previous lectures we discussed about name spaces and how it helps 00:34.740 --> 00:41.690 in grouping or isolating resources like pods, deployments and services. But what about other resources 00:41.710 --> 00:42.130 like 00:42.350 --> 00:47.090 nodes? Can you group or isolate nodes within a namespace? 00:47.240 --> 00:51.980 Like can you say node 01 is part of the dev namespace. 00:51.980 --> 00:56.800 No, those are cluster wide or cluster scoped resources. 00:56.930 --> 01:00.590 They cannot be associated to any particular namespace. 01:00.950 --> 01:08.460 So the resources are categorized as either namespaced or cluster scoped. 01:08.470 --> 01:13.780 Now we have seen a lot of namespaced resources throughout this course. Like pods, replicasets, and 01:13.780 --> 01:21.430 jobs, deployments, services, secrets, and in the last lecture we saw 2 new. Roles and Rolebindings. 01:21.430 --> 01:26.410 These resources are created in the namespace you specify when you create them. 01:26.410 --> 01:32.050 If you don't specify a namespace they are created in the default namespace to view them or delete them 01:32.080 --> 01:32.910 or update them. 01:32.920 --> 01:39.640 you always specify the right namespace. The cluster scoped resources are those where you don’t specify 01:39.640 --> 01:40.440 a namespace. 01:40.510 --> 01:46.780 when you create them. Like nodes, persistent volumes, persistent clusterroles and clusterrolebinding 01:47.200 --> 01:48.100 that we're going to look at. 01:48.100 --> 01:54.790 In this lecture certificate signing requests we saw earlier and namespace objects themselves are of 01:54.790 --> 01:57.880 course not namespaced. 01:57.910 --> 02:05.080 Note that this is not a comprehensive list of resources to see a full list of namespace and non namespace 02:05.080 --> 02:13.750 resources run the kubectl api-resources command with the namespaced option set. In the previous lecture 02:13.840 --> 02:20.680 we saw how to authorize a user to namespace resources We used Roles and Rolebindings for that. But how 02:20.680 --> 02:28.990 do we authorize users to cluster wide resources like nodes or persistent volumes that is where you use 02:29.140 --> 02:36.290 cluster roles and cluster role bindings cluster roles are just like roles except they are for a cluster 02:36.290 --> 02:43.080 scoped resources for example a cluster admin role can be created to provide a cluster administrator 02:43.140 --> 02:46.720 permissions to view create or delete nodes in a cluster. 02:47.400 --> 02:54.210 Similarly if storage administrator role can be created to authorize a storage admin to create persistent 02:54.210 --> 03:01.940 volumes and claims create a cluster all definition file with the kind cluster roll and specify the rules 03:01.970 --> 03:03.990 as we did before this case. 03:04.130 --> 03:09.520 The resources are nodes then create the cluster role. 03:09.660 --> 03:13.480 The next step is to link the user to that cluster role. 03:13.530 --> 03:20.870 For this we create another object called cluster role binding the role binding object links the user 03:21.050 --> 03:22.210 to the role. 03:22.280 --> 03:29.510 We will name it cluster-admin-role-binding. The kind is ClusterRoleBinding. Under subjects we specify 03:29.510 --> 03:35.690 the user details cluster admin user in this case the role ref section is where we provide the details 03:35.780 --> 03:42.890 of the cluster role we created create the role binding using the kubectl create command one thing 03:42.890 --> 03:49.220 to note before I let you go we said that cluster roles and bindings are used for clusters of resources 03:49.670 --> 03:56.230 but that is not a hard rule you can create a cluster role for namespace resources as well. 03:56.510 --> 04:03.540 When you do that the user will have access to these resources across all name spaces. 04:03.650 --> 04:09.260 Earlier when we created a role to authorize a user to access pods the user had access to the pods in 04:09.260 --> 04:12.780 a particular namespace along with cluster rules. 04:12.800 --> 04:20.850 When you authorize a user to access the pods the user gets access to all pods across the cluster. Kubernetes 04:20.880 --> 04:23.960 creates a number of cluster roles by default. 04:24.170 --> 04:30.550 when the cluster is first setup. We will explore those in the practice tests coming up. 04:30.650 --> 04:31.150 Good luck.