How can I set fine-grained permissions for editing deployment images?
Asked by
RandomUser123
I'm looking for a way to allow a user named Foo to edit the image of a specific deployment without giving them permission to modify anything else. I understand that RBAC (Role-Based Access Control) won't address this situation. What solutions or approaches can I use to implement this? I'm comfortable writing some Go code if needed.
Answers
You might want to check out Kyverno or Open Policy Agent. These tools can help you manage permissions in a more granular way. They could be what you're looking for!
Reply to this answer
Honestly, it sounds more like a people management issue than a technical one. If you can't trust that person or team to handle these permissions, maybe you should rethink their access altogether. As a workaround, implementing a CI pipeline that only allows image updates could do the trick.
Reply to this answer
Consider using Custom Resource Definitions (CRDs) to define the permissions you want more precisely.
Reply to this answer
Just a thought, but why allow users to modify images directly on clusters at all? That approach seems risky.
Reply to this answer
You could use RBAC to limit access per namespace or set up an admission controller like Kyverno. I've heard good things about it, but I haven't used admission controllers myself.
Reply to this answer
Add your answer
Answers are reviewed before publication.
KernelPanic24: Absolutely! Also, Validating Admission Policies could be another option. It's built into Kubernetes, so it might save you some integration hassle.