CODEWITHSUNDEEP
kubernetesservice-accounts
Tim
Tim

Reputation: 2066

Limit the Kubernetes service account access specific namespace

I created a service account that contains the default cluster role "view" which makes it can access all of our resources with view permission.

But I would like to add a limitation so that this service account can't access one of our namespace.

Any idea how can I achieve this?

Br,

Tim

Upvotes: 1

Views: 2655

Answers (2)

Rico
Rico

Reputation: 61521

In addition to the other answer, when you use a Role, you need to specify the namespace on your RoleBinding. For example:

$ kubectl create rolebinding my-binding --role=myrole --user=myuser --namespace=mynamespace

Upvotes: 1

Lukas Eichler
Lukas Eichler

Reputation: 5903

Kubernetes has only two permission scopes: Cluster(ClusterRole) or Namespace(Role) and no way to limit or exclude a ClusterRole to specific namespaces. If you want to restrict your ServiceAccount to specific namespaces you cannot use a ClusterRole but must use a Role in every namespace the ServiceAccount should have access in.

Upvotes: 3

Related Questions