01
Include the namespace
Namespaced Roles and RoleBindings need metadata.namespace in this offline snapshot. A ClusterRole referenced by a RoleBinding remains limited to that Binding namespace.
Kubernetes
Kubernetes RBAC viewertrace grants before deployment
Paste Role, ClusterRole and binding manifests; analyze the supplied snapshot when ready.
Kubernetes RBAC viewer
Relationship and findings
Paste RBAC manifests, then analyze.
Manifest content stays in this browser; no cluster connection or network request.
Query a grant
Use * for cluster scope; leave the query fields blank to review the graph only.
Paste manifests to start.
A Kubernetes RBAC viewer helps when a Role looks harmless alone but several bindings grant the same subject broader access. Paste the whole set to see where each grant originates.
This Kubernetes RBAC viewer reads a local manifest snapshot. It separates evidence in the file from live authorization, where group membership, default roles and other authorizers can change the answer.
Why use this Kubernetes RBAC viewer?
Follow the grant and keep uncertainty visible.
A chain for every grant
The RBAC visualizer links a User, Group or ServiceAccount to its Binding, Role and exact rule. A RoleBinding to a ClusterRole stays within the binding namespace; the chain makes that scope visible.
A review signal with a source
The effective permissions view flags wildcard rules, broad Secrets reads and escalation verbs only when a subject is bound. Missing roles and aggregate roles appear as incomplete evidence, not as proven denial.
Read the scope before trusting a match
02
Choose an exact subject
Select the User, Group or ServiceAccount record before asking about a verb. Group grants stay separate because the manifest cannot reveal which Users belong to that Group.
03
Check the named-resource edge
A resourceNames rule needs a resource name. For list or watch it also needs a matching field selector, which this query cannot supply; inspect the caveat before exporting.
Trace, query and review manifest grants
Clickable permission chains
The RoleBinding graph shows subject → binding → role → rule, with namespace and API group retained. Select a chain node to focus the supplied grant paths.
Resource and verb query
The Kubernetes permission checker tests one selected subject, scope, API group, resource or subresource, verb and optional resource name against the pasted rules.
Potential access report
A Kubernetes RBAC viewer report lists broad wildcards, Secrets reads, bind/escalate/impersonate and pods/exec with the granting Binding. Copy or download the Markdown review.
What the manifest can and cannot establish
- No cluster verdict
- This Kubernetes RBAC viewer does not connect to a cluster or call SubjectAccessReview. A missing match is not an online Forbidden response; default roles, other bindings and authorizers may be absent.
- Unknown relationships stay unknown
- A missing roleRef or an aggregate ClusterRole without all selected members produces an incomplete report. User-to-Group membership is never inferred from a username.
- Resource rules only
- NonResourceURLs are preserved as unevaluated findings. The query does not discover custom resource scope, apply manifests, generate policy or turn pods permission into pods/exec.
Kubernetes RBAC viewer questions
Why does a RoleBinding grant access in one namespace but not across all namespaces?
A RoleBinding confines even a referenced ClusterRole to its own namespace. For a cluster-wide grant, Kubernetes uses a ClusterRoleBinding; this viewer shows the distinction in each chain.
Can one ServiceAccount have multiple RoleBindings?
Yes. RBAC grants are additive. The Kubernetes RBAC viewer keeps every matching binding as a separate source rather than picking one winning role.
Does list on Secrets let a subject read their contents?
Listing Secrets can reveal the objects and their data in the response even when get on an individual Secret is absent. A resourceNames restriction changes how list/watch must be requested.
Can a ServiceAccount in one namespace read a Secret in another?
A binding in the target namespace may name a ServiceAccount from a different namespace. Supply that ServiceAccount namespace explicitly so this static trace does not merge two identities.
Can Kubernetes RBAC explicitly deny a permission?
No. RBAC rules only add grants. This manifest checker reports matching grants and uncertainty; it cannot prove the full live authorization outcome.
Still have an RBAC question?
Use the Kubernetes RBAC viewer now
Paste the complete role and binding set, trace a subject, then save the report for review.
Analysis runs in this browser.