<p>I granted read access to pod</p>
<p>Sample:</p>
<pre><code>kubectl create serviceaccount sa1 

kubectl create role pod-reader --verb=get --resource=pods

kubectl create rolebinding sa1-binding --serviceaccount=default:sa1 --role=pod-reader 
</code></pre>
<p>Is there any way to restrict this access to selected pods on the basis of metadata or labels?</p>

Dev
<p>As far as I'm aware, it's not possible to limit roles to certain labels. Actually there was an issue related to this opened here: <a href="https://github.com/kubernetes/kubernetes/issues/44703" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/44703</a></p>
<p>With RBAC you're specifying access to resources, which are part of API groups and you select what verbs can be executed - that's all.</p>
