Marcus Noble • 1/20/2022

Restricting cluster-admin Permissions

This technical article discusses a limitation of Kubernetes RBAC, which only allows adding permissions. It details a real-world problem where a buggy CLI tool used by cluster-admins was causing issues, and explains how the team at Giant Swarm used the Kyverno admission controller to create a ClusterPolicy that blocks specific delete actions, effectively restricting permissions even for users with the cluster-admin role.

0 comments

#Kubernetes #Rbac #Cluster Admin