<p>I am currently facing the current situation. I want to give users access to individual namespaces, such that they can</p>
<ul>
<li>create and deploy ressources with Helm charts (for instance, from Bitnami)</li>
</ul>
<p>On the other hand the users are not supposed to</p>
<ul>
<li>create/retrieve/modify/delete RBAC settings like ServiceAccounts, RoleBindings, Roles, NetworkPolicies</li>
<li>get hands on secrets associated to ServiceAccounts</li>
</ul>
<p>Of course, the crucial thing is to define the best Role for it here. Likely, the following is not the best idea here:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: role
  namespace: example-namespace
rules:
- apiGroups: [&quot;*&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
</code></pre>
<p>Hence, it would be great if you could come along with some sensible approach that the users can work on it as freely as possible, yet do not get hands on some more &quot;dangerous&quot; resources.</p>
<p>In essence, I want to follow the workflow outlined here (<a href="https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html" rel="nofollow noreferrer">https://jeremievallee.com/2018/05/28/kubernetes-rbac-namespace-user.html</a>). So what matters most is that individual users in one namespace, cannot read the secrets of the users in the same namespace, such that they cannot authenticate with the credentials of someone else.</p>

tobias
<p>In my opinion the following strategy will help:</p>
<ol>
<li>RBAC to limit access to service accounts of own namespace only.</li>
<li>Make sure <strong><code>automountServiceAccountToken: false</code></strong> in secret and POD level using policies. This helps in protecting secrets when there is a node security breach. The secret will only be available for execution time and will not be stored in the POD.</li>
</ol>
<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server</a></p>
<ol start="3">
<li>Encrypt secrets stored in ETCD using kms(recommended). But if you dont have a kms provider then you can also choose other providers to ensure minimum security.</li>
</ol>
<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/#providers</a></p>
