<p>I have a Kubernetes cluster where my application is deployed.
there are some other users they should only be able to copy files into and from a pod. Using kubectl cp command. 
This user context should not allow the user to do any other operations on the cluster other than kubectl cp.</p>

Nagasitaram Thigulla
<p><code>kubectl cp</code> internally uses <code>exec</code>. There is no way to provide permission to only copy but you can provide only <code>exec</code> permission.</p>

<p>Create a role with permission to <code>pods/exec</code></p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-exec
rules:
- apiGroups: [""]
  resources: ["pods/exec"]
  verbs: ["create"]
</code></pre>

<p>Create a Rolebinding to assign the above role to a <code>user</code>.</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pod-exec-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: pod-exec
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: user
</code></pre>
