CODEWITHSUNDEEP
kubernetesopenshiftrbac
tal
tal

Reputation: 11

Kubernetes RBAC set subtraction / cluster-admin without capabilities

Is it possible to create a Kubernetes cluster admin without the ability to modify/read certain namespace and its content?

I am talking about subtracting certain permissions from existing role.

thanks.

Upvotes: 1

Views: 254

Answers (1)

Ramesh kollisetty
Ramesh kollisetty

Reputation: 291

To get the behavior you want you would need a set subtraction of cluster-admin role minus the rules that you have defined. It's not supported in K8s as of this writing.

If you need a custom role which has less permissions than a predefined role, it would be more clear to list those permissions rather than to list the inverse of those permissions.

Upvotes: 1

Related Questions