<p>Is it possible to create a Kubernetes cluster admin without the ability to read namespace secrets? </p>

<p>I know you can create a ClusterRole and list every single resource and omit secret but seems unintuitive. </p>

<p>Can you use Aggregated ClusterRoles to remove a permission? so using ClusterRole cluster-admin and have a role that uses:</p>

<pre><code>rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: [""]
</code></pre>

<p>Not really <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles" rel="nofollow noreferrer"><code>Aggregated Cluster Roles</code></a> is a <a href="https://en.wikipedia.org/wiki/Union_(set_theory)" rel="nofollow noreferrer">set union</a> of several <code>ClusterRole</code>s. To get the behavior you want you would need a <a href="https://en.wikipedia.org/wiki/Complement_(set_theory)" rel="nofollow noreferrer">set subtraction</a> of cluster-admin role minus the rules that you have defined. <a href="https://github.com/kubernetes/kubernetes/issues/70387" rel="nofollow noreferrer">It's not supported in K8s as of this writing</a>.</p>
