<p>I have a external service name type service created for RDS in Namespace1.
I dont want pods or any resource in namespace2 to access the rds service in namespace2.
I tried with below code but still I am able to access.
Any idea why its not working?</p>
<pre><code>   ---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: mysqlsa
  namespace: namespace2
automountServiceAccountToken: false
---
apiVersion: v1
kind: Pod
metadata:
  name: mysql-client
  namespace: namespace2
spec:
  serviceAccountName: mysqlsa
  containers:
  - image: mysql:8
    command:
      - sleep
      - &quot;3600&quot;
    imagePullPolicy: IfNotPresent
    name: busybox
  restartPolicy: Always
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: namespace2
  name: mysqlaccess
rules:
- apiGroups: [&quot;*&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;,&quot;create&quot;,&quot;update&quot;,&quot;patch&quot;,&quot;delete&quot;] 
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: mysqlaccess-binding
  namespace: namespace2
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: mysqlaccess 
subjects: 
- kind: ServiceAccount
  name: mysqlsa 
  namespace: namespace2 
</code></pre>
<p>I am able to connect to rds service in namespace1</p>
<pre><code> kubectl exec -it mysql-client  -n namespace2 -- bash                       
    bash-4.4# mysql -h my-database-svc.namespace1.svc.cluster.local -P 3306 -u admin -ppassword
    mysql: [Warning] Using a password on the command line interface can be insecure.
    Welcome to the MySQL monitor.  Commands end with ; or \g.
    Your MySQL connection id is 900
    Server version: 8.0.32 Source distribution
    
    Copyright (c) 2000, 2023, Oracle and/or its affiliates.
    
    Oracle is a registered trademark of Oracle Corporation and/or its
    affiliates. Other names may be trademarks of their respective
    owners.
    
    Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
    
    mysql&gt; exit
</code></pre>
<p>Auth shows no</p>
<pre><code>kubectl auth can-i list services --as=system:serviceaccount:namespace2:mysqlsa -n namespace1
    no
</code></pre>

Rad4
<p>The DNS lookup doesn't use the Kubernetes API and doesn't take any credentials.  Kubernetes RBAC rules don't apply here.</p>
<p>I don't believe there's any way to prevent a Service name from resolving in selected Pods.  (A comment suggested network policies; those only apply at the IP/CIDR-block level.)</p>
<p>In this example, hiding the ExternalName Service wouldn't really do anything.  That Service just provides a DNS alias inside the cluster; if the caller knew the AWS host name of the RDS instance, it could directly connect to the RDS instance anyways.  A caller would also need to know the credentials to access the database.  I wouldn't especially worry about this case.</p>
