<p>Is there a way we can make Kubernetes read-only? I would like to temporarily disallow making changes to my K8s cluster for sometime, but continue to allow all <code>get</code> operations. And then turn it back on.</p>

UnderWood
<p>As far as I know, there is no easy switch to do it. </p>

<p>As I understand, you use a multi-tenant Kubernetes cluster - multiple users are working on it and can do operations. In this case, I assume only one person is the cluster admin. And as the admin, you want to prevent <em>everybody else</em> from any write operations (but not yourself), and turn write access back on after certain period.</p>

<p>So, the best way I can think of is, assuming you have RBAC enabled in your cluster, you can find out which <code>Role</code>/<code>RoleBinding</code>/<code>ClusterRole</code>/<code>ClusterRoleBinding</code>s are giving your users the rights to modify the resources on the cluster. Then, you can write a script that exports those resources, deletes them from the cluster, and creates new ones that only gives view access.</p>

<p>When you want to turn write access back on, you can delete the view-only resources you created, and re-apply the previous resources - put everything back to their places.</p>

<p>Writing this script wouldn't be trivial. You would need to go through <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC docs</a> quite well to understand how it works.</p>
