<p>Let us assume we are the owners of a Kubernetes cluster and we give other users in our organization access to individual namespaces, so they are not supposed to know what is going on in other namespaces.</p>
<p>If user A deploys a certain ressource like a Grafana-Prometheus monitoring stack to namespace A, how do we ensure that he cannot see with the monitoring stack anything from namespace B, where he should not have any access to.</p>
<p>Of course, we will have to limit the rights of user A anyhow, but how do we automatically limit the rights of it's deployed ressources in namespace A? In case you have any suggestions perhaps with some Kubernetes configuration examples, that would be great.</p>

tobias
<p>The most important aspect of this question is to control the access permission of the service accounts which will be used in the Pods and a network policy which will limit the traffic within the namespace.</p>
<p>Hence we arrive to this algorithm:</p>
<p><strong>Prerequisite:</strong>
Creating the user and namespace</p>
<pre><code>sudo useradd user-a
kubectl create ns ns-user-a
</code></pre>
<ol>
<li>limiting access permission of user-a to the namespace ns-user-a.</li>
</ol>
<pre><code>kubectl create clusterrole permission-users --verb=* --resource=*
kubectl create rolebinding permission-users-a --clusterrole=permission-users --user=user-a --namespace=ns-user-a
</code></pre>
<ol start="2">
<li>limiting all the service accounts access permission of namespace ns-user-a.</li>
</ol>
<pre><code>kubectl create clusterrole permission-serviceaccounts --verb=* --resource=*
kubectl create rolebinding permission-serviceaccounts --clusterrole=permission-serviceaccounts --namespace=ns-user-a --group=system:serviceaccounts:ns-user-a
kubectl auth can-i create pods  --namespace=ns-user-a --as-group=system:serviceaccounts:ns-user-a --as sa
</code></pre>
<ol start="3">
<li>A network policy in namespace ns-user-a to limit incoming traffic from other namespaces.</li>
</ol>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-from-other-namespaces
  namespace: ns-user-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector: {}
</code></pre>
<p><strong>Edit: Allowing traffic from selective namespaces</strong></p>
<p>Assign a label to the monitoring namespace with a custom label.</p>
<pre><code>kubectl label ns monitoring nsname=monitoring
</code></pre>
<p>Or, use the following <strong>reserved labels from kubernetes</strong> to make sure nobody can edit or update this label. So by convention this label should have &quot;monitoring&quot; as assigned value for the &quot;monitoring&quot; namespace.</p>
<p><a href="https://kubernetes.io/docs/reference/labels-annotations-taints/#kubernetes-io-metadata-name" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/labels-annotations-taints/#kubernetes-io-metadata-name</a></p>
<pre><code>kubernetes.io/metadata.name

</code></pre>
<p>Applying a network policy to allow traffic from internal and monitoring namespace.</p>
<p>Note: Network policies always add up. So you can keep both or you can only keep the new one. I am keeping both here, for example purposes.</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-only-monitoring-and-inernal
  namespace: ns-user-a
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector: {}    # allows traffic from ns-user-a namespace (same as earlier)
    - namespaceSelector: # allows traffic from monitoring namespace
        matchLabels:
          kubernetes.io/metadata.name: monitoring
</code></pre>
