<p>I have a cluster hosted on GKE, I have several deployments on this cluster, <br>I can connect with <code>kubectl exec</code> to the pods:</p>

<p><code>kubectl exec -it mypod-1234566-7890976  -- bash</code></p>

<p>I want to remove the option to connect with <code>kubectl exec</code> to a certain container </p>

<p>is there a way to block the option to connect to the container by blocking the ssh on the <code>DOCKERFILE</code> of the container? or any other way</p>

<p>To limit the ability to <code>kubectl exec</code> to pods what you want to do is create a custom Role &amp; RoleBinding that removes the <code>create</code> verb for the <code>pods/exec</code> resource. An easy approach to this might be to copy the default RBAC policies, and then make the appropriate edit and rename.</p>

<p>Because of how RBAC works, the finest granularity you could apply to this is per-namespace, but it's not possible to filter this to a particular pod/deployment/etc.</p>

<p>As for other inbound external connections to a pod, this shouldn't be possible by default, unless you have created an Ingress and/or Service to specifically do this. This is because by in large most providers will be using private IP address ranges for the node IP's and also the Pod networking, hence they aren't reachable from outside without some NAT'ing or Proxying.</p>

<p>Hope this helps.</p>
