<p>Team, I have below cluster role on kubernetes that allows access to everything but I wan't to restrict node level commands and allow all rest.</p>
<p>What to modify below?
Basically, user should be able to run</p>
<pre><code>kubectl get all --all-namespaces
</code></pre>
<p>but not nodes info should NOT display</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: &quot;true&quot;
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin-test
rules:
  - apiGroups:
      - '*'
    resources:
      - '*'
    verbs:
      - '*'
  - nonResourceURLs:
      - '*'
    verbs:
      - '*'
</code></pre>

<p>Rules are purely additive, means that you cannot restrict rules.</p>

<p>Thus, you will need to list all accessible <a href="https://kubernetes.io/docs/reference/kubectl/overview/#resource-types" rel="noreferrer">resources</a>, but "nodes" with appropriate <a href="https://kubernetes.io/docs/reference/kubectl/overview/#operations" rel="noreferrer">operations</a></p>

<p>For example:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: cluster-admin
rules: 
- apiGroups: [""] 
  resources: ["pods","services","namespaces","deployments","jobs"] 
  verbs: ["get", "watch", "list"]
</code></pre>

<p>Also, it is highly not recommended to change <strong>cluster-admin</strong> role.
It is worth to create a new role and assign users to it.</p>
