How to provide access to a service account to read pods in multiple namespaces?

Question

I'm going over RBAC in Kubernetes. It appears to me that

a ServiceAccount can be bound to a Role within a namespace (or)
a ServiceAccount can be bound to a ClusterRole and have cluster-wide access (all namespaces?)

Is it possible for a single Service Account (or User) to not have cluster-wide access but only have read-only access in only a subset of namespaces? If so, can someone elaborate on how this can be achieved. Thanks!

I think the solution is to define multiple RoleBinding for the one service account for each namespace in which you wish it permitted. — DazWilkin
– DazWilkin, Commented Mar 19, 2019 at 3:04

Lukas Eichler · Accepted Answer · 2019-03-19 08:35:13Z

You need to create a RoleBinding for every namespace in each namespace the ServiceAccount should have access to.

There is an example to give the default ServiceAccount permissions to read pods in the development namespace.

kind: RoleBinding apiVersion: rbac.authorization.k8s.io/v1 metadata: name: read-secrets namespace: development # This only grants permissions within the "development" namespace. subjects: - kind: ServiceAccount name: default namespace: kube-system roleRef: kind: Role name: pod-reader apiGroup: rbac.authorization.k8s.io

Collectives™ on Stack Overflow

How to provide access to a service account to read pods in multiple namespaces?

1 Answer 1

Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Related