Openshift - RBAC rolebinding limit permission

user_18783583 0
Viewed 64

I am currently trying to implement a role that can just manage permission for certain namespaces. The goal of this role is to be able to give the role view and edit to other users in namespace where the account which will have the managerrole will be in.

The problem I am facing is that I can currently give the role edit and view, but I can give those roles to the managerrole account as well. That allows him to read secrets of a namespace and I do not want that.

Furthermore, the managerrole can also delete rolebindings that are above his current permissions (e.g. managerrole can delete a rolebinding of an admin of the namespace).

Basically, I would like to restrict the managerrole so it :

  1. Cannot give to himself the role edit (rolebinding for specific namespace)
  2. Cannot delete rolebinding above his role (rolebinding for specific namespace - e.g. admin)
openshift rbac
1 Answers

Its not possible for managerole to not have edit /view permissions for itself because it can only manage the same for others if has those permissions for itself.

for example , an administrator can only provide admin permissions to someone else if he himself has the same or more permissions.

user_184589460
Related