<p>I am trying to find our the minimum privileges required for application to communicate in kubernetes for the below scenarios</p>

<ol>
<li>App1 is in namespace 1 and app2 is in namespace 2</li>
<li>App1 is in cluster 1 anf app2 is in cluster 2</li>
</ol>

<p>I have deployed an sample application in my cluster (<a href="https://github.com/kubernetes/kubernetes/tree/release-1.2/examples/guestbook" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/tree/release-1.2/examples/guestbook</a>) in two different namespaces</p>

<p>However tough I associate these applications with service account have no privileges in respective namespaces , my php application is still able to reach redis application.
I was expecting it to throw an error , how are my applications functioning even after giving my service account no roles</p>

<p>Below is the role i associated with my service account</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
 name: no-access-cr
rules:
- apiGroups: [""] # "" indicates the core API group
  resources: [""] 
  verbs: [""]
</code></pre>

<p>Kindly assist!!!</p>

sai prashanth
<p>RBAC policies that you're applying to applications have nothing to do with networking (L3/L4) itself. They are related to L7 access to k8s APIs (kube-api server) and therefore access to k8s objects exposed via these APIs.</p>

<p>If you want to restrict access between the apps on networking level (L3/L4) you need to apply <a href="https://kubernetes.io/docs/concepts/services-networking/network-policies/" rel="nofollow noreferrer">network policies</a> Also depending on network plugin e.g. <a href="https://docs.projectcalico.org/reference/resources/networkpolicy" rel="nofollow noreferrer">calico policies</a> can be used.</p>
