Kubernetes RBAC 集减法 / cluster-admin 没有能力

Question

Is it possible to create a Kubernetes cluster admin without the ability to modify/read certain namespace and its content?

I am talking about subtracting certain permissions from existing role.

thanks.

Answer 1

To get the behavior you want you would need a set subtraction of cluster-admin role minus the rules that you have defined. It's not supported in K8s as of this writing.

If you need a custom role which has less permissions than a predefined role, it would be more clear to list those permissions rather than to list the inverse of those permissions.