<p>Is it possible to create a Kubernetes cluster admin without the ability to modify/read certain namespace and its content?</p>
<p>I am talking about subtracting certain permissions from existing role.</p>
<p>thanks.</p>

<p>To get the behavior you want you would need a <a href="https://en.wikipedia.org/wiki/Complement_(set_theory)" rel="nofollow noreferrer">set subtraction</a> of cluster-admin role minus the rules that you have defined. <a href="https://github.com/kubernetes/kubernetes/issues/70387" rel="nofollow noreferrer">It's not supported in K8s as of this writing.</a></p>
<p>If you  need a custom role which has less permissions than a predefined role, it would be more clear to list those permissions rather than to list the inverse of those permissions.</p>
