<p>i would like to create a new cluster-role that is basically the same as the <code>cluster-admin</code> but without the ability for users to:</p>

<p>1) create, modify or delete <code>PV</code>s
2) create, modify or delete <code>namespace</code>s.
3) prevent view, create, modify, delete of new rbac permissions.</p>

<p>How do i do this?</p>

<p>i was trying to take inspiration fro the <code>cluster-admin</code> role, but everything was specified as with <code>*</code>.</p>

yee379
<p>There are unfortunately no "negative" permissions, so that you could start from all permissions (with <code>*</code>) and then take away specific permissions. If you don't want <em>all</em> items of a set (which you could specify with <code>*</code>), you have to enumerate all of those items that you want.</p>

<p>You can find a complete list of resources and their <a href="https://kubernetes.io/docs/concepts/overview/kubernetes-api/#api-groups" rel="nofollow noreferrer">API groups</a> with:</p>

<pre class="lang-sh prettyprint-override"><code>kubectl api-resources
</code></pre>

<p>In your case, PVs and namespaces are in the core API group and RBAC resources are in the <code>rbac.authorization.k8s.io</code> API group. So, it's only in these two API groups that you would need to enumerate all resources that you want to grant permissions for. Regarding all the other API groups, you can just list them in a single RBAC <code>rule</code> and set <code>resources</code> and <code>verbs</code> to <code>*</code>.</p>

<hr>

<p>Your ClusterRole definition might look something like this (however, the precise set of API groups and resources might be different in your cluster):</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: my-cluster-admin
rules:
  # Read permissions for PVs and namespaces in the core API group
  - apiGroups: [""]
    resources: [persistentvolumes, namespaces]
    verbs: [get, list]
  # Full permissions for all other resources in the core API group
  - apiGroups: [""]
    resources: [bindings, componentstatuses, configmaps, endpoints, events, limitranges, nodes, persistentvolumeclaims, pods, podtemplates, replicationcontrollers, resourcequotas, secrets, serviceaccounts, services]
    verbs: ['*']
  # Full permissions for all API groups except "core" and "*.authorization.k8s.io"
  - apiGroups: [admissionregistration.k8s.io, apiextensions.k8s.io, apiregistration.k8s.io, apps, authentication.k8s.io, autoscaling, batch, certificates.k8s.io, coordination.k8s.io, crd.k8s.amazonaws.com, events.k8s.io, extensions, monitoring.coreos.com, networking.k8s.io, policy, scheduling.k8s.io, storage.k8s.io]
    resources: ['*']
    verbs: ['*']
  # Full permissions for all non-resource URLs
  - nonResourceURLs: ['*']
    verbs: ['*']
</code></pre>

<p>You can generate the list of API groups and resources by doing some text manipulation on the output of <code>kubectl api-resources</code>.</p>

<p>The definition has four rules which should achieve what you want:</p>

<ol>
<li>Only read permissions for PVs and namespaces</li>
<li>Full permissions for all other resources (except PVs and namespaces) in the core API group</li>
<li>Full permissions for all API groups except core and *.authorization.k8s.io (there are no permissions for *.authorization.k8s.io at all)</li>
<li>Full permissions for all non-resource URLs</li>
</ol>
