<p>I didn't get how I can restrict the access of custom resources in Openshift using RBAC</p>
<p>let's assume I have a custom api:</p>
<pre><code>apiVersion: yyy.xxx.com/v1
kind: MyClass
metadata:
   ...
</code></pre>
<p>Is it possible to prevent some users to deploy resources where <code>apiVersion=yyy.xxx.com/v1</code> and <code>kind=MyClass</code>?</p>
<p>Also can I grant access to other users to deploy resources where <code>apiVersion=yyy.xxx.com/v1</code> and <code>kind=MyOtherClass</code>?</p>
<p>If this can be done using RBAC roles, how can I deploy RBAC roles in Openshift? only using CLI or I can create some yaml configuration files and deploy them with Yaml for example?</p>

Fabry
<p>You can use cluster roles and RBAC roles:</p>
<pre><code>oc adm policy add/remove-cluster-role-to-group oauth:system:authenticated
</code></pre>
<p>So the general idea is to remove the permission to deploy the resource to all the authenticated users.
The next step is to add the permission to deploy that resourse only to ServicesAccounts assigned to specific namepsaces</p>
