<p>I want to use the ClusterRole <strong>edit</strong> for some users of my Kubernetes cluster (<a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles</a>).</p>
<p>However, it is unfortunate that the user can be accessing and modifying Resource Quotas and Limit Ranges.</p>
<p>My question is now: How can I grant Users via a RoleBinding access to a namespace, such that the Role is essentially the CluserRole <strong>edit</strong>, but without having any access to Resource Quotas and Limit Ranges?</p>

tobias
<p>The <code>edit</code> role gives only <em>read</em> access to <code>resourcequotas</code> and <code>limitranges</code>:</p>
<pre><code>- apiGroups:
  - &quot;&quot;
  resources:
  - bindings
  - events
  - limitranges
  - namespaces/status
  - pods/log
  - pods/status
  - replicationcontrollers/status
  - resourcequotas
  - resourcequotas/status
  verbs:
  - get
  - list
  - watch
</code></pre>
<p>If you want a role that doesn't include read access to these resources, just make a copy of the <code>edit</code> role with those resources excluded.</p>
