<p>I'm trying to lock down a namespace in kubernetes using <strong>RBAC</strong> so I followed this <a href="https://blog.viktorpetersson.com/2018/06/15/kubernetes-rbac.html" rel="nofollow noreferrer">tutorial</a>.<br>
I'm working on a <strong>baremetal cluster</strong> (no minikube, <strong>no cloud provider</strong>) and installed kubernetes using Ansible.</p>

<p>I created the folowing <strong>namespace :</strong></p>

<pre><code>apiVersion: v1
kind: Namespace
metadata:
  name: lockdown
</code></pre>

<p><strong>Service account :</strong></p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-lockdown
  namespace: lockdown
</code></pre>

<p><strong>Role :</strong></p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: lockdown
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: [""]
  verbs: [""]
</code></pre>

<p><strong>RoleBinding :</strong></p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rb-lockdown
subjects:
- kind: ServiceAccount
  name: sa-lockdown
roleRef:
  kind: Role
  name: lockdown
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>And finally I tested the authorization using the next command</p>

<pre><code>kubectl auth can-i get pods --namespace lockdown --as system:serviceaccount:lockdown:sa-lockdown
</code></pre>

<p>This <strong>SHOULD</strong> be returning "No" but I got "Yes" :-(  </p>

<p>What am I doing wrong ?<br>
Thx</p>

Doctor
<p>A couple possibilities:</p>

<ol>
<li>are you running the "can-i" check against the secured port or unsecured port (add --v=6 to see). Requests made against the unsecured (non-https) port are always authorized. </li>
<li>RBAC is additive, so if there is an existing clusterrolebinding or rolebinding granting "get pods" permissions to that service account (or one of the groups system:serviceaccounts:lockdown, system:serviceaccounts, or system:authenticated), then that service account will have that permission. You cannot "ungrant" permissions by binding more restrictive roles</li>
</ol>
