Look at what the cluster ships with:
sh
kubectl get clusterroles
kubectl get clusterrolebinding cluster-admin -o jsonpath='{.subjects[0]}'Auditors should read everything, everywhere, but never Secrets. view is exactly that:
sh
kubectl create clusterrolebinding auditors-view --clusterrole=view --group=auditors
kubectl auth can-i get deployments --as ana --as-group auditors -A
kubectl auth can-i get secrets --as ana --as-group auditors -n citadel-1bu7tunThe CI account ci should be able to deploy into citadel-1bu7tun and nowhere else. Bind the ClusterRole edit with a RoleBinding:
sh
kubectl create serviceaccount ci -n citadel-1bu7tun
kubectl create rolebinding ci-edit --clusterrole=edit --serviceaccount=citadel-1bu7tun:ci -n citadel-1bu7tun
kubectl auth can-i create deployments --as system:serviceaccount:citadel-1bu7tun:ci -n citadel-1bu7tun
kubectl auth can-i create deployments --as system:serviceaccount:citadel-1bu7tun:ci -n default