Is it possible to create a Kubernetes cluster admin without the ability to modify/read certain namespace and its content?
I am talking about subtracting certain permissions from existing role.
thanks.
1 Answers
To get the behavior you want you would need a set subtraction of cluster-admin role minus the rules that you have defined. It's not supported in K8s as of this writing.
If you need a custom role which has less permissions than a predefined role, it would be more clear to list those permissions rather than to list the inverse of those permissions.
Related