<p>I have an application namespace with 30 services. Most are stateless Deployments, mixed with some StatefulSets etc. Fairly standard stuff that is.</p>

<p>I need to grant a special user a Role that can only exec into certain Pod. Currently RBAC grants the exec right to all pods in the namespace, but I need to tighten it down.</p>

<p>The problem is Pod(s) are created by a Deployment <code>configurator</code>, and the Pod name(s) are thus "generated", <code>configurator-xxxxx-yyyyyy</code>. Since you cannot use glob (ie. <code>configurator-*</code>), and Role cannot grant exec for Deployments directly.</p>

<p>So far I've thought about:</p>

<ul>
<li>Converting Deployment into StatefulSet or a plain Pod, so Pod would have a known non-generated name, and glob wouldn't be needed</li>
<li>Moving the Deployment into separate namespace, so the global exec right is not a problem</li>
</ul>

<p>Both of these work, but neither is optimal. Is there a way to write a proper Role for this?</p>

<p>RBAC, as it is meant by now, doesn't allow to filter resources by other attributes than namespace and resource name. The discussion is open <a href="https://github.com/kubernetes/kubernetes/issues/44703#issuecomment-324826356" rel="nofollow noreferrer">here</a>.</p>

<p>Thus, namespaces are the smallest piece at authorizing access to pods. Services must be separated in namespaces thinking in what users could need access to them.</p>

<p>The optimal solution right now is to move this deployment to another namespace since it needs different access rules than other deployments in the original namespace.</p>
