<p>I'm using G
I want to create a custom user that have only access to specific namespace, I used this yaml:</p>

<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: develop-user
  namespace: develop

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: develop-user-full-access
  namespace: develop
rules:
- apiGroups: rbac.authorization.k8s.io
  resources:
  - services
  verbs: ["get"]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: develop-user-view
  namespace: develop
subjects:
- kind: ServiceAccount
  name: develop-user
  namespace: develop
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: develop-user-full-access
</code></pre>

<p>so I get a certificate and added to my kube config, after I switched context to this new service account and figured out that I still have access to everything :(<br>
Why did it happen and how to fix?</p>

<p>my kubeconfig (pastebin copy: <a href="https://pastebin.com/s5Nd6Dnn" rel="nofollow noreferrer">https://pastebin.com/s5Nd6Dnn</a>):</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: %certificate-data%
    server: https://animeheaven.nyah
  name: anime-cluster-develop
contexts:
- context:
    cluster: anime-cluster-develop
    namespace: develop
    user: develop-user
  name: anime-develop
current-context: anime-develop
kind: Config
preferences: {}
users:
- name: develop-user
  user:
    client-key-data: %certdata%
    token: %tokenkey%
</code></pre>

<p><a href="https://medium.com/uptime-99/making-sense-of-kubernetes-rbac-and-iam-roles-on-gke-914131b01922" rel="nofollow noreferrer">https://medium.com/uptime-99/making-sense-of-kubernetes-rbac-and-iam-roles-on-gke-914131b01922</a><br>
<a href="https://medium.com/@ManagedKube/kubernetes-rbac-port-forward-4c7eb3951e28" rel="nofollow noreferrer">https://medium.com/@ManagedKube/kubernetes-rbac-port-forward-4c7eb3951e28</a></p>

<p>these two articles helped me finally! I almost felt into depression because of this stupid stuff, thanks to uptime-99 and ManagedKube I did it! yay!</p>

<p>the key is to create kubernetes-viewer user in gcloud and then create a role for him
here is a hint!</p>

<pre><code>---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: develop
  name: allow-developer-port-forward
rules:
- apiGroups: [""]
  resources: ["pods", "pods/portforward"]
  verbs: ["get", "list", "create"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: anime-developer-port-access
  namespace: develop
subjects:
- kind: User
  name: ANIMEDEVERLOP@gmail.com
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: allow-developer-port-forward
  apiGroup: ""
</code></pre>

<p>then  </p>

<blockquote>
  <p>kubectly apply -f accessconfig.yaml  </p>
</blockquote>

<p>thats it!<br>
have a nice day!</p>
