<p>Is it possible to create a kubernetes RBAC rule that allows creating a Job from an existing CronJob, but prevents creating a Job any other way?</p>
<p>We want to keep our clusters tightly locked down to avoid arbitrary deployments not managed by CICD - but we also need to facilitate manual testing of CronJobs, or rerunning failed jobs off schedule. I'd like developers to be able to run a command like:</p>
<pre><code>kubectl create job --from=cronjob/my-job my-job-test-run-1
</code></pre>
<p>But not be able to run something like:</p>
<pre><code>kubectl create job my-evil-job -f evil-job.yaml
</code></pre>
<p>Is that possible?</p>

<p>In this scenario in order to successfully execute this command:</p>
<pre><code>kubectl create job --from=cronjob/&lt;cronjob_name&gt;  
</code></pre>
<p>User/ServiceAccount should have proper <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> rules (at least two from the output provided below, create <code>Jobs</code> and get <code>CronJobs</code>.</p>
<p>In first example I granted access to create <code>Jobs</code> and get <code>CronJobs</code> and I was able to create <code>Job</code> and <code>Job --from CronJob</code></p>
<pre><code>user@minikube:~$ cat test_role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: job
rules:
- apiGroups: [&quot;batch&quot;]
  resources: [&quot;jobs&quot;]
  verbs: [&quot;create&quot;]
- apiGroups: [&quot;batch&quot;]
  resources: [&quot;cronjobs&quot;]
  verbs: [&quot;get&quot;]
user@minikube:~$ kubectl create job --image=inginx testjob20
job.batch/testjob20 created
user@minikube:~$ kubectl create job --from=cronjobs/hello testjob21
job.batch/testjob21 created
</code></pre>
<p>But if I granted access only to create <code>Job</code> without get <code>CronJob</code>, I was be able to create <code>Job</code> but not to create <code>Job --from CronJob</code></p>
<pre><code>user@minikube:~$ cat test_role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: job
rules:
- apiGroups: [&quot;batch&quot;]
  resources: [&quot;jobs&quot;]
  verbs: [&quot;create&quot;]
user@minikube:~$ kubectl create job --image=nginx testjob3
job.batch/testjob3 created
user@minikube:~$ kubectl create job --from=cronjobs/hello testjob4
Error from server (Forbidden): cronjobs.batch &quot;hello&quot; is forbidden: User &quot;system:serviceaccount:default:t1&quot; cannot get resource &quot;cronjobs&quot; in API group &quot;batch&quot; in the namespace &quot;default&quot;
</code></pre>
<p>When I deleted access to create <code>Jobs</code>, I couldn't create <code>Job</code> and also <code>Job --from CronJob</code></p>
<pre><code>user@minikube:~$ cat test_role
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: job
rules:
- apiGroups: [&quot;batch&quot;]
  resources: [&quot;cronjobs&quot;]
  verbs: [&quot;get&quot;]
user@minikube:~$ kubectl create job --image=inginx testjob10
error: failed to create job: jobs.batch is forbidden: User &quot;system:serviceaccount:default:t1&quot; cannot create resource &quot;jobs&quot; in API group &quot;batch&quot; in the namespace &quot;default&quot;  
user@minikube:~$ kubectl create job --from=cronjobs/hello testjob11
error: failed to create job: jobs.batch is forbidden: User &quot;system:serviceaccount:default:t1&quot; cannot create resource &quot;jobs&quot; in API group &quot;batch&quot; in the namespace &quot;default&quot;
</code></pre>
<p>As you can see if User/ServiceAccount doesn't have both permission in this scenario it's impossible to create (<code>Job</code> or <code>Job --from CronJob</code>) so it's impossible to create such restrictions using only RABC rules.</p>
<p>One possible solution is to split this permission into two different User/ServiceAccount for two different tasks (first user can create <code>Jobs</code> + get <code>CronJobs</code>, second user without permission to create <code>Jobs</code>).</p>
<p>Another possibility is to try to use k8s admission Controller with f.e. <a href="https://www.openpolicyagent.org/docs/v0.12.2/kubernetes-admission-control/" rel="nofollow noreferrer">Open Policy agent</a></p>
