<p>How to create one user called <code>kubernetes-dashboard</code> and that user access my all the namespaces ns1, ns2, ns3, ns5 except ns4.</p>

Gaurav Agnihotri
<ul>
<li>I have created sample namespaces ns1,ns2,ns3 &amp; ns4.
i want  my new user to have access to ns1,ns2,ns3 but not to ns4</li>
</ul>
<pre><code>kubectl get ns
NAME              STATUS   AGE
calico-system     Active   21h
default           Active   21h
kube-node-lease   Active   21h
kube-public       Active   21h
kube-system       Active   21h
ns1               Active   36m
ns2               Active   36m
ns3               Active   36m
ns4               Active   36m
tigera-operator   Active   21h
</code></pre>
<ol>
<li>Create a <a href="https://github.com/kubernetes/dashboard/blob/master/docs/user/access-control/creating-sample-user.md#creating-a-service-account" rel="nofollow noreferrer">sample service account</a> named &quot;kubernetes-dashboard&quot; in default namespace:</li>
</ol>
<pre><code>[root@project1kubemaster ~]# kubectl create serviceaccount kubernetes-dashboard
serviceaccount/kubernetes-dashboard created

</code></pre>
<ol start="2">
<li>Create <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#clusterrole-example" rel="nofollow noreferrer">ClusterRole</a> named &quot;kubernetes-dashboard-role&quot;</li>
</ol>
<pre><code>[root@project1kubemaster ~]# kubectl create clusterrole kubernetes-dashboard-role --verb=* --resource=*
clusterrole.rbac.authorization.k8s.io/kubernetes-dashboard-role created

</code></pre>
<ol start="3">
<li>Create separate <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-example" rel="nofollow noreferrer">RoleBinding</a> in each namespaces of our interest (ns1,ns2,n3) but not on ns4:</li>
</ol>
<pre><code>[root@project1kubemaster ~]# kubectl create rolebinding kubernetes-dashboard-rolebinding-ns1 --clusterrole=kubernetes-dashboard-role --namespace=ns1 --serviceaccount=default:kubernetes-dashboard
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-rolebinding-ns1 created

[root@project1kubemaster ~]# kubectl create rolebinding kubernetes-dashboard-rolebinding-ns2 --clusterrole=kubernetes-dashboard-role --namespace=ns2 --serviceaccount=default:kubernetes-dashboard
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-rolebinding-ns2 created

[root@project1kubemaster ~]# kubectl create rolebinding kubernetes-dashboard-rolebinding-ns3 --clusterrole=kubernetes-dashboard-role --namespace=ns3 --serviceaccount=default:kubernetes-dashboard
rolebinding.rbac.authorization.k8s.io/kubernetes-dashboard-rolebinding-ns3 created
</code></pre>
<ol start="4">
<li>Testing :</li>
</ol>
<pre><code>[root@project1kubemaster ~]# kubectl auth can-i get pods -n ns1 --as  system:serviceaccount:default:kubernetes-dashboard
yes
[root@project1kubemaster ~]# kubectl auth can-i get pods -n ns2 --as  system:serviceaccount:default:kubernetes-dashboard
yes
[root@project1kubemaster ~]# kubectl auth can-i get pods -n ns3 --as  system:serviceaccount:default:kubernetes-dashboard
yes
[root@project1kubemaster ~]# kubectl auth can-i get pods -n ns4 --as  system:serviceaccount:default:kubernetes-dashboard
no
</code></pre>
