<p>How do you disable shell or bash access to pods in a container? I do not want anyone to get access inside the pod via kubectl exec or docker exec or via k9s</p>

Ajinkya16
<p>Kubectl is a CLI tool so it connects with the <strong>K8s</strong> <strong>API server</strong> and authenticates.</p>
<p>You can restrict the user by their Role, so using the <strong>RBAC</strong> with proper permission will resolve your issue.</p>
<p>Ref : <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a></p>
<p><strong>Example</strong> :</p>
<pre><code>---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: serviceaccount
  namespace: default

---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: default-user-role
  namespace: default
rules:
- apiGroups: [&quot;&quot;]
  resources:
  - pods/attach
  - pods/exec
  verbs: [&quot;&quot;]
- apiGroups: [&quot;&quot;, &quot;extensions&quot;, &quot;apps&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]

---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: default-user-view
  namespace: default
subjects:
- kind: ServiceAccount
  name: serviceaccount
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: default-user-role
</code></pre>
<p>check auth using the</p>
<pre><code>kubectl auth can-i --as=system:serviceaccount:default:serviceaccount exec pod
</code></pre>
