<p>I have a Kubernetes Cluster running on Azure (AKS) with NGINX Ingress in front.</p>

<p>I'm a little bit confused how to seperate access on the diffrent ressources for multiple Users.</p>

<p>The users should work on the apps. That's why it is fine if they can read logs, descriptions and exec some commands inside of the pods. But they should never adjust some Ingress ressources.</p>

<p>Microsoft provide a very good tutorial how to handle cases like that on AKS: <a href="https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac" rel="nofollow noreferrer">https://learn.microsoft.com/en-us/azure/aks/azure-ad-rbac</a></p>

<p>There is an example how to add permissions to a group to the whole namespace.</p>

<p>My Question is now, how can I add permissions for a group to specific ressources inside of a namespace.</p>

<p>For example I have following ressources:</p>

<pre><code>ressource              type        namespace     

ingress-controller     pod         nginx-ingress
ingress-service        service     nginx-ingress
ingress-nginx          ingress     nginx-ingress
app1-service           service     nginx-ingress
app1                   pod         nginx-ingress
app2-service           service     nginx-ingress
app2                   pod         nginx-ingress
</code></pre>

<p>From my understanding I need to deploy all of them in the same namespace, otherwise the ingress can't forward the requests. 
But how I can grant read, write, execute permissions to group1 for app1 and app1-service, and read to the rest?</p>

Nico Schuck
<p>You can specify specific resources by name in RBAC roles with the <code>resourceNames</code> field.</p>

<p>Create a Role that allows full access to <code>app1</code> and <code>app1-service</code>:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: app1-admin
rules:
- apiGroups:
  - ""
  resourceNames:
  - app1
  - app1-service
  resources:
  - pods
  - pods/exec
  - service
  verbs:
  - get
  - list
  - watch
  - create
</code></pre>

<p>Create Role that allows read access to all other Pods and Services:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: read-all
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - service
  verbs:
  - get
  - list
  - watch
</code></pre>

<p>Create two RoleBindings that bind both of these Roles to the <code>group1</code> group:</p>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: app1-admin-group1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: app1-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: group1
</code></pre>

<pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-all-group1
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: read-all
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: Group
  name: group1
</code></pre>

<p>Now, members of <code>group1</code> should have full access to Pod <code>app1</code> and Service <code>app1-service</code>, but only read access to all other resources.</p>
