Multi-Tenant EKS RBAC Pack

EKS RBAC for Real Teams — Four Personas, Ready to Apply

Standing up RBAC from scratch means deciding what each role should be able to do, writing the YAML correctly, and not accidentally granting cluster-admin to the intern. This pack ships four battle-tested personas that cover the access tiers most teams actually need.

The Four Personas

• Read-Only Viewer — can describe and get most resources, no mutations, safe for on-call reference or auditors
• Developer — full CRUD scoped to own namespace; cannot touch cluster-level resources, other namespaces, or RBAC itself
• Platform Engineer — broad cluster read access, can manage deployments and namespaces, cannot escalate privileges or modify cluster-level RBAC
• Break-Glass Emergency — cluster-admin equivalent with a short-lived token pattern, audit-logged, designed for incident response

What You Get

• clusterroles/ — ClusterRole manifests for each persona
• roles/ — namespace-scoped Role variants with parameterized namespace names
• bindings/ — example RoleBinding and ClusterRoleBinding templates
• break-glass/ — short-lived token generation script and audit setup
• README.md explaining each permission decision and how to extend the roles

Requirements

• EKS or any Kubernetes >= 1.21
• kubectl with cluster-admin access to apply roles
• AWS IAM entries for aws-auth ConfigMap (EKS-specific steps included)