Scenario

A monitoring application needs read-only access to pods in the demo namespace.

Task

Set up RBAC so the ServiceAccount can only get, list, and watch Pods in that namespace.

Step 1: Create the ServiceAccount

kubectl create serviceaccount reader-sa -n demo

Step 2: Create the Role

kubectl create role pod-reader -n demo --verb=get,list,watch --resource=pods

Step 3: Create the RoleBinding

kubectl create rolebinding pod-reader-binding -n demo --role=pod-reader --serviceaccount=demo:reader-sa

Step 4: Verify

kubectl auth can-i list pods -n demo --as=system:serviceaccount:demo:reader-sa
kubectl auth can-i delete pods -n demo --as=system:serviceaccount:demo:reader-sa