<p>Is it possible to restrict the ability of particular users to dynamically provision disks from storageclasses? Or, for example, only allowing particular namespaces to be able to use a storageclass?</p>

dippynark
<p>Fair warning: I haven't tested this!</p>

<p>StorageClass is just an API endpoint, and RBAC works by restricting access to those endpoints, so in theory this should work just fine:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: sc_access
rules:
- apiGroups: ["storage.k8s.io", "core" ]
  resources: [ "storageclass" ]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
</code></pre>

<p>If that doesn't work, you might be able to restrict access directly via the NonResourceUrls option:</p>

<pre><code>rules:
- nonResourceURLs: ["/storage.k8s.io/v1/storageclasses"]
  verbs: ["get", "post"]
</code></pre>
