This is something I have implemented recently.
NOTE: I'm assuming you are aware ho to add users. or users in group in this case.
here is what I have applied:
- kind: Group
You can use either
ClusterRoleBinding or else just
Rolebinding, depending on your requirement. In case you are not looking for cluster scoped access, instead just a namespace, I would strongly suggest going with the
Rolebinding kind of object.
What I'm doing/creating in the above?
I'm creating one RBAC Role (
readonly_role) scoped to Cluster.
and in that I'm specifying I want to let access
deployments. additionally you. can also add things like
services or else if you just want to give access to all specify
in the 2nd part, I'm creating a ClusterRoleBinding Object named
bind_readonly_dev_role which ensures only users in group
myorg:readonly are having this role or privileges in the role we just created (
NOTE: Incase you want to allow proxy access to certain applications, like
you might have to specify them separately in the
I do like this for one of my svc:
at last but not least, you have to test if the user has those privileges correct,
you can test like this:
kubectl auth can-i get pods --as myorg:readonly
in the above replace the pods with the object you want the users of the group to have access to.
Hope this helps!