<p>Consider the RBAC role below. Is it possible to write a more sophisticated regex for <code>resources:</code> that prevents access to service accounts and namespaces but allows everything else? </p>

<pre><code>- apiGroups:
  "*"
  resources:
  "*"
  verbs:
  "*"
</code></pre>

kgunjikar
<p>A simple workaround for it is to disable possibility to access resources within namespace. Execute command:</p>

<pre><code>$ kubectl api-resources --namespaced=false
</code></pre>

<p>Non-namespaced resources will be returned, otherwise returning namespaced resources by default.</p>

<p>Also while you are using:</p>

<ul>
<li><p>apiGroups:
"*"  - this means that you want to grant access for all groups within Kubernetes API (both core API gorups and named groups )</p></li>
<li><p>resources:
"*" - this means that you want to grant access for all resources  (get, services, endpoints etc.)</p></li>
<li>verbs:
"*" - this means that you want to allow operations on specified objects (get, list, edit etc.).</li>
</ul>

<p>In your case as you defined you don't prevent access but give it to every object etc.</p>

<p>Take a look on: <a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#api-resources" rel="nofollow noreferrer">api-resources</a>.</p>
