<p>i would like to know if is possible to isolate namespace on Azure Kubernetes service. Now if i give rbac role to my colleague they can see all namespace, i would like to segregate namespace for department, e.g. data can see only data namespace, dev can see only den namespace etc..</p>
<p>is it possible?</p>
<p>Thanks</p>

<p>yes, You have to Enable <code>AKS-managed Azure Active Directory</code>, <code>Role-based access control (RBAC)</code> &amp; <a href="https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac?toc=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fazure%2Faks%2Ftoc.json&amp;bc=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fazure%2Fbread%2Ftoc.json#create-the-aks-cluster-resources-for-app-devs" rel="nofollow noreferrer">Azure RBAC for Kubernetes Authorization</a>. There are 2 options:</p>
<pre><code>az aks create \
  -g myResourceGroup \
  -n myManagedCluster \
  --enable-aad \
  --enable-azure-rbac
</code></pre>
<p>1st Option:</p>
<pre><code>---
apiVersion: v1
kind: Namespace
metadata:
  name: data
  labels:
    kubernetes.io/metadata.name: data
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: data-view-access
  namespace: data
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
- kind: Group
  namespace: data
  name: &lt;GROUP_OBJECT_ID&gt;
</code></pre>
<p>2nd Option is to use Azure Custom Roles as explained <a href="https://learn.microsoft.com/en-us/azure/aks/manage-azure-rbac#create-role-assignments-for-users-to-access-cluster" rel="nofollow noreferrer">here</a> and also with this example from user yk1 :</p>
<pre><code>az role assignment create \
  --role &quot;Azure Kubernetes Service RBAC Reader&quot; \
  --assignee &lt;AAD-ENTITY-ID&gt; \
  --scope $AKS_ID/namespaces/&lt;namespace-name&gt;
</code></pre>
<p>NOTE: All users must be member of <code>Azure Kubernetes Service Cluster User Role</code> in order the execute <code>az aks get-credentials</code></p>
