<p>I am trying to set access control for using the &quot;shell&quot; UI button on the deploy dashboard, and only need this for one single pod. By using the k8s RBAC auth model, I need something like this and binding to a role:</p>
<p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
<div class="snippet-code">
<pre class="snippet-code-html lang-html prettyprint-override"><code>- apiGroups: [""]
  resources: ["pods/exec"]
  resourceNames: [“api-server-f5b95446b-58wz4”]
  verbs: ["create"]</code></pre>
</div>
</div>
</p>
<p>However, the postfix &quot;-f5b95446b-58wz4&quot; is randomly generated during deploy time, and it will change constantly. So this solution won't work.</p>
<p>If the resourceNames could support wild card string then it will resolve my issue, but looks like it is a known gap and not supported ATM (<a href="https://github.com/kubernetes/kubernetes/issues/56582" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/issues/56582</a>)</p>
<p>Anyone idea if there is better way that I can achieve this? Thanks!</p>

DubsWin
<p>You can use a policy engine like Kyverno to control what can/cannot. Example, prevent exec into to a specific pod filter by name like <a href="https://kyverno.io/policies/other/block-pod-exec-by-pod-and-container/" rel="nofollow noreferrer">this</a>.</p>
