Allowing patching of Kubernetes resource metadata through a role

Question

Is it somehow possible to seperately allow patching of resources' metadata through a role in a Kubernetes cluster?

I would like to solely allow patching of namespace's metadata without giving write permissions to the whole namespace object.

The usecase is to allow deployment pipelines to add/change annotations to the namespace without giving them full control.

Answer 1

To add/change namespace's metadata without giving write permissions to the whole namespace object, you can create a RBAC role where you can restrict access to namespace resources. So that deployment pipeline can have access to change only the metadata i.e., annotations to the namespace without giving them full control.

An RBAC Role contains rules that represent a set of permissions. Permissions are purely additive (there are no "deny" rules).

A Role always sets permissions within a particular namespace; when you create a Role, you have to specify the namespace it belongs in.

Let us consider an example Role in the namespace that can be used to grant read access to resources pods and services:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: <namespace-name>
  name: read-access
rules:
- apiGroups: [""] 
  resources: ["pods", “services”]
  verbs: ["get", "watch", "list"]

To grant read access to all the resources which are mentioned in the namespace, use this special character “*” in the resources field i.e., resources: ["*”].

Note : If you want to restrict resources to a specific user you can use Rolebinding. A role binding grants the permissions defined in a role to a user or set of users. It holds a list of subjects (users, groups, or service accounts), and a reference to the role being granted. A RoleBinding grants permissions within a specific namespace

Refer RBAC Role for more information.