<p>Situation:<br>
- users A, B, C, D<br>
- team 1: user A, user B<br>
- team 2: user C, user D  </p>

<p>Desired:<br>
- each user has private volume<br>
- each team has a shared volume --> users in team can see shared volume<br>
- some users, based on permission, can see <em>both</em> shared volumes</p>

<p>Searched for quite some time now, do not see a solution in the Docs.</p>

<p>Ideas:<br>
- Use Namespaces! problem --> can no longer see shared volume of other Namespace</p>

<p>This is an example of how you would do it. You can use namespaces for the different teams.</p>

<p>Then you can use a <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings" rel="nofollow noreferrer"><code>Role</code></a> for each volume and assign to users accordingly. (Roles are namespaced). A sample Role would be:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: team1
  name: volume-access
rules:
- apiGroups: [""]
  resources: ["persistentvolume", "persistentvolumeclaims"]
  resourceNames: ["my-volume"]
  verbs: ["update", "get", "list", "patch", "watch"]
</code></pre>

<p>Then your binding would be something like:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pv-binding
  namespace: team1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: volume-access
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: usera
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: userb
</code></pre>

<p>The above would be shared by user A and user B. You can create separate roles for the volume that is private.</p>
