<p>My goal is to create a Kubernetes role to limit kubectl exec access on pods under a specific deployment. I have a policy built below that successfully creates the role when the number &amp; names of my pods are all static. The problem is that my deployment horizontally autoscales so if a new pod is created then the role will not apply to that new pod (since each pod name is explicitly defined in the role) &amp; the new pod will have a random hash appended to its name.</p>

<p>Format below is in Terraform but its the same high level structure as a role defined in yaml</p>

<pre><code>resource kubernetes_cluster_role alb_exec_role {
  metadata {
    name = "alb-exec-role"
  }

  rule {
    api_groups     = [""]
    resources      = ["pods", "pods/log"]
    resource_names = [&lt;pod names&gt;]
    verbs          = ["get", "list"]
  }

  rule {
    api_groups     = [""]
    resources      = ["pods/exec"]
    resource_names = [&lt;pod names&gt;]
    verbs          = ["create"]
  }
}
</code></pre>

user3088470
<p>Foremost, why not remove <code>pod/exec</code> from all Pods in that <code>Role</code>, and then whitelist those which you <strong>do</strong> tolerate exec-ing into?</p>

<p>That said, the thing you want is likely a custom controller which listens to Pod events in that Namespace and updates the RBAC <code>Role</code> when the new Pod is created or scheduled.</p>
