<p>I want to restrict users under RBAC AKS/kubernetes cluster namespace to fetch only secrets but not TLS secrets. I have my cluster role with the following api permissions. But it does not work iam unable to restrict users from fetching only secrets and not TLS secrets.</p>

<p>Code:</p>

<pre><code>---
#ClusterRole-NamespaceAdmin-RoleGranter
---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  # "namespace" omitted since ClusterRoles are not namespaced
  name: clusterrole-ns-admin
rules:
  # "Pods" rules
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
  # "Nodes" rules - Node rules are effective only on cluster-role-binding
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["get", "list", "watch", "create", "update", "delete"]
  # "Secrets" rules
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch", "create","update", "delete"]
  # "TLS Secrets" rules
- apiGroups: [""]
  resources: ["secrets"]
  resourceNames: ["kubernetes.io/tls"]
  verbs: ["get", "watch", "list"]
</code></pre>

<p>Thanks in advance!</p>

CloudA2Z
<p>Short answer is it's not possible. There is only kind <code>Secret</code> resource in Kubernetes and you can apply RBAC on a kind. There is no separate kind for TLS secret.</p>
