<p>I am using RBAC to restrict a user <code>john</code> to work and create resources only in their namespace <code>test-namespace</code>.</p>

<p>Here is what I've done:</p>

<p>1) Generate certificates for a user and create <code>set-context</code></p>

<pre><code>kubectl config set-credentials john --client-certificate=/home/john/.certs/employee.crt  --client-key=/home/john/.certs/employee.key
kubectl config set-context john-context --cluster=minikube --namespace=test-namespace --user=john
</code></pre>

<p>2) Create a Role to manage deployments in the namespace <code>test-namespace</code>.</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: test-namespace
  name: deployment-authority
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods"]
  verbs: ["get", "create", "update", "patch", "delete"]
</code></pre>

<p>3) Create a RoleBinding.</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: deployment-authority-binding-john
  namespace: test-namespace
subjects:
- kind: User
  name: john
  apiGroup: ""
roleRef:
  kind: Role
  name: deployment-authority
  apiGroup: ""
</code></pre>

<p>Now all of the above works and I can run the command <code>kubectl --context=john-context run --image busybox busybox</code> without any issue. </p>

<p>Now I also have a Unix user on my Kubernetes Master node whose user name is john. My aim to make sure that when that user is logged in, he (john) can run commands allowed to him in his context <code>john-context</code>. I'm unable to link the UNIX user to the Kubernetes user. </p>

<p>Something like :</p>

<pre><code>john@kubernet:/$ id
uid=1002(john) gid=1002(john) groups=1002(john)

john@kubernet:/$ kubectl get po -n test-namespace
NAME                       READY     STATUS    RESTARTS   AGE
grafana-67c6585fbd-tlr4n   1/1       Running   2          23h
</code></pre>

<p>But if I switch over to another user on my Unix machine, he/she should not be able to see anything or do anything in namespace <code>test-namespace</code>.</p>

<pre><code>su - tom
tom@kubernet:/$ id
uid=1004(tom) gid=1004(tom) groups=1004(tom)
john@kubernet:/$ kubectl get po -n test-namespace
You are not allowed to view resources in this namespace
</code></pre>

<p>Any suggestions will be much appreciated. </p>

<p>You can just manage this through your <code>~/.kube/config</code> file on your users' home directories. Say in <code>/home/john/.kube/config</code> you would have something like this:</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0xxxxxxxxo=
    server: https://172.1.1.1:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: default
    user: john
  name: john@kubernetes
current-context: john@kubernetes
kind: Config
preferences: {}
users:
- name: john
  user:
    client-certificate-data: LS0txxxxo=
    client-key-data: LS0xxxxx==
</code></pre>

<p>And then you'd make sure that file only has <code>600</code> permissions.</p>
