<p>First off, I'm aware of the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes RBAC</a> method. My question is: is there a way to create Kubernetes resources that can only be read and/or written by a specific <code>Role</code> (or a <code>ClusterRole</code>)?</p>
<p>For example, let's say I have a Kubernetes <code>Secret</code>. I want this <code>Secret</code> to be bound to a specific <code>ClusterRole</code>, then only a <code>ServiceAccount</code> bound to this specific <code>ClusterRole</code> could read it. Is there a way to set up something like that?</p>
<p><strong>Edit</strong>: it looks like what I want here is not possible. Kubernetes RBAC was designed to <em>GRANT</em> access to certain resources. I wanted to <em>DENY</em> access based on a specific group (or set of rules).</p>

robotic_chaos
<p>You can use the RBAC for managing the Role-based access in K8s</p>
<blockquote>
<p>For example, let's say I have a Kubernetes Secret. I want this Secret
to be bound to a specific ClusterRole, so only a ServiceAccount bound
to this specific ClusterRole could read it. Is there a way to set up
something like that?</p>
</blockquote>
<p>No, you can not use the <code>ClusterRole</code> for granular level access, however, you can create some <code>Role</code> to restrict <strong>secret</strong>.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: secret-read-role
rules:
- apiGroups: [&quot;*&quot;] 
  resources: [&quot;secret&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;]  
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: secret-read-sa
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: secret-read-rolebinding
  namespace: default
subjects:
- kind: ServiceAccount
  name: secret-read-sa
  apiGroup: &quot;&quot;
roleRef:
  kind: Role
  name: secret-read-role
  apiGroup: &quot;&quot; 
</code></pre>
<p>Checkout about the <strong>resourceNames</strong> you can also give a name or pattern in name so this way it might be helpful to attach a specific secret to <strong>Role</strong>.</p>
<pre><code>- apiGroups: [&quot;&quot;]
  resources: [&quot;namespaces&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
  resourceNames: [&quot;userA-*&quot;]
</code></pre>
<p>If you planning to Go with <strong>RBAC</strong> you can use the <code>RBAC manager</code> for better management : <a href="https://github.com/FairwindsOps/rbac-manager" rel="nofollow noreferrer">https://github.com/FairwindsOps/rbac-manager</a></p>
<p><strong>Extra</strong> :</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: data-engineering
name: umbrella:data-engineering-app
rules:
– apiGroups: [“”]
resources: [“configmaps”]
resourceNames:  [“data-engineering-app-configmap”]    &lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;&lt;
verbs: [“get”]
—
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: RoleBinding
metadata:
name: umbrella:data-engineering-app
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: umbrella:data-engineering-app
subjects:
– kind: ServiceAccount
name: data-engineering-app
namespace: data-engineering
</code></pre>
<p>You can also refer to resources by name for certain requests through the <strong>resourceNames</strong> list. When specified, requests can be restricted to individual instances of a resource. Here is an example that restricts its subject to only get or update a <code>ConfigMap</code> named <code>my-configmap</code></p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: configmap-updater
rules:
- apiGroups: [&quot;&quot;]
  #
  # at the HTTP level, the name of the resource for accessing ConfigMap
  # objects is &quot;configmaps&quot;
  resources: [&quot;configmaps&quot;]
  resourceNames: [&quot;my-configmap&quot;]
  verbs: [&quot;update&quot;, &quot;get&quot;]
</code></pre>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources</a></p>
<p>Good Example : <a href="https://thenewstack.io/three-realistic-approaches-to-kubernetes-rbac/" rel="nofollow noreferrer">https://thenewstack.io/three-realistic-approaches-to-kubernetes-rbac/</a></p>
