Cannot get a kubeconfig for a ServiceAccount to work correctly
I have an issue with creating namespaces, serviceaccounts, roles, rolebindings and kubeconfig files.
In the future we will have multiple teams/ applications landing on Kubernetes and I want to create a namespace per team. We are using Kubernetes on Azure (AKS) and the default created kubeconfig is not something to just handover to all teams. So I thought I would create a serviceaccount per namespace and create a role + rolebinding. So I tried it locally with minikube.
I first created the resources:
And then I created the config file for the serviceaccount: 
But with this config file I can still see all resources in all namespaces and I cannot figure out what I am doing wrong. Hopefully someone can help me out.
Kind regards, Bram
Similar Questions
1 Answer
Your configuration looks well, but service-accounts are designed for accessing Kubernetes from the inside of cluster or for accessing it by other services.
In your case, the better option would be using User with a role binding.
Here is a good instruction from Bitnami how to do that.
In a few words, you should:
- Create The User Credentials
- Create The Role For Managing Deployments
- Bind The Role To The Employee User
Regarding your problem, please check your Minikube configuration and ensure that RBAC is enabled.
You can use --extra-config=apiserver.Authorization.Mode=RBAC option to launch minikube with enforced RBAC authorization.