<p>We're creating dynamic test environments for our developers. Each environment goes into one namespace called <code>test-&lt;something&gt;</code>, where <code>&lt;something&gt;</code> is entered by the developer when creating the environment (we use Gitlab-CI for the automation).</p>
<p>We want to grant them limited access to the K8s API to see deployments, exec into pods for instance. So the plan is to apply a (cluster)role (yet to decide) like this.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: &quot;{{ ns }}&quot;
  name: &quot;test-{{ ns }}&quot;
rules:
- apiGroups: [&quot;apps&quot;]
  resources: [&quot;deploys&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;, &quot;pods/log&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/exec&quot;]
  verbs: [&quot;create&quot;]
</code></pre>
<p>However we preferably don't want to apply it for all namespaces but only the <code>test-*</code> ones.</p>
<p>We could add the creation of the namespaced role and rolebinding during the app deploy, but that would mean granting our Gitlab-CI runner the permission to create and delete roles and rolebindings. We're concerned by the security implications of this and the possible privilege escalations.</p>
<ul>
<li>Is it possible to create a clusterrolebinding limited to a regexp-ed set of namespaces?</li>
<li>Alternatively, if we want to grant the permissions via the automation, is it possible to limit the namespaces where the rolebindings can be created by the runner?</li>
</ul>
<p>We looked at the docs but couldn't find such things</p>
<p>Worst case scenario is probably to go for the clusterrolebinding route and not give too many privileges to the automation. So asking if we can find a better way</p>
<p>Thanks in advance</p>

<p>I also stumbled into this problem and <a href="https://kubernetes.io/blog/2020/08/14/introducing-hierarchical-namespaces/" rel="nofollow noreferrer">Hierarchical Namespaces</a> seem like a decent solution, as you can give the permissions to a single &quot;static&quot; namespace. Every namespace afterwards will inherit the permissions. Hope it helps.</p>
