Search code examples
kuberneteskubectlrbac

Allow only listing of resources using Kubernetes RBAC

I want to allow only listing of resources and not the manifest content.

Example,

NAME                                 READY   STATUS    RESTARTS   AGE
airflow-redis-0                      1/1     Running   0          32h
airflow-postgresql-0                 1/1     Running   0          32h
airflow-scheduler-9416ddfd6f-n7jcr   2/2     Running   0          32h
airflow-webserver-9bf7f3c95c-kf1fx   1/1     Running   0          32h
airflow-worker-0                     2/2     Running   0          4h8m

With GET permission users can see the manifest of the pod individually. For example, kubectl describe pod airflow-worker-0 -n airflow

Similarly, with LIST permission users can see the manifest of all the pods with commands like - kubectl get pod --output=json

Is it possible to restrict manifest access and just allow the listing of resources in K8 RBAC?

Solution

  • Showing only a listing of resources and not the object content is not possible by using any of the RBAC request verbs.

    list can't be used. It provides the listing but will also allow accessing full object content.