<p>We've multiple k8s clusters which are used by many teams for their microservices. We've restricted the <code>kubectl</code> access to the limited members only. But many times we get a request for allowing <code>readonly kubectl</code> access. </p>

<p>Many on k8s clusters are running on <code>ec2</code> &amp; provisioned via <code>kops</code>.
Version details : </p>

<pre><code>$ kubectl version --short
Client Version: v1.13.0
Server Version: v1.11.6
---
$ kops version
Version 1.12.2
</code></pre>

<p>I tried to create a <code>test-pod</code> with <code>kubectl</code> installed in it which readonly <code>clusterrole</code> &amp; <code>clusterrolebinding</code> attached. I can see that the <code>kubectl</code> from within the pod can have readonly access but it needs me to <code>kubectl exec</code> into the pod. So, I don't know how can I restrict this access ?</p>

<p>I have tried <a href="https://medium.com/@rschoening/read-only-access-to-kubernetes-cluster-fcf84670b698" rel="nofollow noreferrer">this</a> but still don't know how to restrict access.</p>

K.Thanvi
<p>You need to make users in whatever authentication system you are using and then set the role binding to be aimed at those users, not a service account. Service accounts are for services, not humans.</p>
