<p>I have setup my cluster (k3d) to have some RBAC rules and also created a certificate to identify my user for <code>kubectl</code> commands. I've set the user to have a <code>Role</code> via a <code>RoleBinding</code> in a specific namespace.</p>
<p>I want to make it so they could create <code>Deployment</code>s, <code>Pod</code>s, <code>Service</code>s but not create a <code>Secret</code> or <code>ConfigMap</code>. If I do that though, will they be able to use Helm to install things? Doesn't Helm store its info about releases in <code>Secret</code>s or <code>ConfigMap</code>s?</p>
<p>Do I need to grant the user access to also create those things?</p>
<p><em>Example Role</em></p>
<pre class="lang-yaml prettyprint-override"><code>#################################################################################
################################## Example Role #################################
#################################################################################

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-role
  namespace: my-namespace
rules:
  - apiGroups: [&quot;&quot;, &quot;extensions&quot;, &quot;apps&quot;]

    # Leaving out &quot;configmaps&quot; and &quot;secrets&quot;
    resources: [&quot;pods&quot;,&quot;deployments&quot;,&quot;services&quot;]
    verbs: [&quot;*&quot;]
</code></pre>

Don Rhummy
<p>Yes unfortunately you have to. But from the bright side you can put limitations by defining verbs as</p>
<pre><code>[&quot;get, list, create&quot;]
</code></pre>
<p>not</p>
<pre><code>[&quot;*&quot;]
</code></pre>
<p>This gives full authority.
I suggest you to check <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac</a>
to get a clear view and determine your needs and abilities on the kubernetes side.</p>
<p>Example verbs:</p>
<pre><code>verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
</code></pre>
<p>Also you can check your users abilities by using the can-i tool in the link below.</p>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authorization/</a></p>
<p>Hope these links can help you.</p>
<p>Btw, look at the charts and yaml files for Kind: labels.</p>
<p>Those are the things you will need access to.</p>
