Search code examples
kubernetesgoogle-cloud-platformgoogle-kubernetes-enginegoogle-cloud-iam

How to restrict termination of k8s clusters within a project

How to restrict termination of k8s clusters within a project, to certain users:

  1. dev team creates project-dev k8s cluster
  2. qa team creates project-qa k8s cluster
  3. prod team creates project-prod k8s cluster

How can we prevent dev, qa, prod team members from deleting clusters which they didn't create.

How should we set up RBAC for a Google Cloud project?

Solution

  • You need to create a project for each team and they create the cluster in their project. If you don't grant the teams in other projects, they won't be able to touch them.