<p>I've tried creating a cluster role that only has access to view pods, however, for some reason that account can still see everything; secrets, deployments, nodes etc. I also enabled skip-login, and it seems like by default anonymous users don't have any restrictions either. </p>

<p><strong>Service account:</strong></p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
name: sa-example
namespace: default
</code></pre>

<p><strong>Cluster Role:</strong></p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-example
rules:
- apiGroups: [""] 
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p><strong>Cluster Role Binding:</strong></p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crb-example
roleRef:
  apiGroup: rbac.authorization.k8s.io
  name: cr-example
  kind: ClusterRole
subjects:
  - kind: ServiceAccount
    name: sa-example
    namespace: default
</code></pre>

<p><strong>Context:</strong></p>

<pre><code>K8s version: 1.17.3
Dashboard version: v2.0.0-rc5
Cluster type: bare metal
authorization-mode=Node,RBAC
</code></pre>

Gaby
<p>How did You check if it works or no?</p>

<p>I made a reproduction of your issue with below yamls</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa-example
  namespace: default

---  

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cr-example
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]        

---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: crb-example
roleRef:
  apiGroup: rbac.authorization.k8s.io
  name: cr-example
  kind: ClusterRole
subjects:
  - kind: ServiceAccount
    name: sa-example
    namespace: default
</code></pre>

<p>And I used <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access" rel="nofollow noreferrer">kubectl auth can-i</a> to verify if it works </p>

<pre><code>kubectl auth can-i get pods   --as=system:serviceaccount:default:sa-example
yes
kubectl auth can-i get deployment   --as=system:serviceaccount:default:sa-example
no
kubectl auth can-i get secrets   --as=system:serviceaccount:default:sa-example
no
kubectl auth can-i get nodes   --as=system:serviceaccount:default:sa-example
no
</code></pre>

<p>And it seems like everything works just fine</p>

<p>The only thing which if different in my yaml is </p>

<pre><code>kind: ClusterRole
metadata:
  name: cr-example instead of cr-&lt;role&gt;
</code></pre>

<p>So it actually match ClusterRoleBinding</p>

<p>I hope it help you with your issues. Let me know if you have any more questions.</p>
