Kubernetes RBAC cluster-admin 无密读权限

Question

Is it possible to create a Kubernetes cluster admin without the ability to read namespace secrets?

I know you can create a ClusterRole and list every single resource and omit secret but seems unintuitive.

Can you use Aggregated ClusterRoles to remove a permission? so using ClusterRole cluster-admin and have a role that uses:

rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: [""]

Answer 1

Not really Aggregated Cluster Roles is a set union of several ClusterRole s. To get the behavior you want you would need a set subtraction of cluster-admin role minus the rules that you have defined. It's not supported in K8s as of this writing .