How to restrict a user to one namespace on kubernetes Dashboard?

Question

I have a custom role related to a specific namespace. I want to create a service account that will have access to the Dashboard and only being able to see this namespace assigned to that role.

I have tried the following:

apiVersion: v1
kind: Namespace
metadata:
  name: namespace-green
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: green
  namespace: kubernetes-dashboard
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: role-green
  namespace: namespace-green
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["*"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: testDashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: role-green
subjects:
- kind: ServiceAccount
  name: green
  namespace: kubernetes-dashboard

I retrieved the token with the following command:

kubectl -n kubernetes-dashboard describe secret $(kubectl -n kubernetes-dashboard get secret | grep green | awk '{print $1}')

When I login to the Dashboard I see only the default namespace although I have assigned the new namespace to that role.

I am not able to to figure out how to view the resources of the new namespace only and based on the permissions of the role the service account should have limited access.

Answer 1

You dont need to create a new role. You can just create a RoleBinding to the 'edit' clusterrole with the new service account you have created and it will work as you expect it to. Also the access will be limited to just one namespace - kubernetes-dashboard

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: testDashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: edit
subjects:
- kind: ServiceAccount
  name: green
  namespace: kubernetes-dashboard

After that the you can use the same old token to test.