Is there a way to allow user to view some of the pods in a namespace using k8s rbac

Question

I need to know is there any way to allow user to view only selected pods in a namespace using rbac I can allow user to view all the pods in a namespace but I couldn't allow selected pods. Is this possible using RBAC or should I try a different approach to achieve this.

Answer 1

It seems that RBAC doesn't really directly allow restricting access to specific pods within a namespace.but there are still some approaches that you can try.

1. Limiting RBAC to Namespaces. You can assign the user a ClusterRole or Role that limits access to specific namespaces where they only have read access to pods. This provide coarse-grained control but doesn't allow restricting visibility within a single namespace.

2. Leveraging Pod labels and annotations. Label the pods you want the user to access and create a ClusterRole or Role that allows reading pods with specific labels. This approach requires labeling your pods consistently and might become complex if managing many pods.

3. Utilizing Pod Security Policies(PSPs). Define PSPs with specific rules defining which users can access pods based on labels, annotations, or other attributes.

4. Implementing a custom solution. Develop a custom admission controller or webhook to intercept pod access to those service accounts instead of individual pods.This might not be applicable in all scenarios and requires managing service account permissions.