My goal is to create a Kubernetes role to limit kubectl exec access on pods under a specific deployment. I have a policy built below that successfully creates the role when the number & names of my pods are all static. The problem is that my deployment horizontally autoscales so if a new pod is created then the role will not apply to that new pod (since each pod name is explicitly defined in the role) & the new pod will have a random hash appended to its name.

Format below is in Terraform but its the same high level structure as a role defined in yaml

resource kubernetes_cluster_role alb_exec_role {
  metadata {
    name = "alb-exec-role"
  }

  rule {
    api_groups     = [""]
    resources      = ["pods", "pods/log"]
    resource_names = [<pod names>]
    verbs          = ["get", "list"]
  }

  rule {
    api_groups     = [""]
    resources      = ["pods/exec"]
    resource_names = [<pod names>]
    verbs          = ["create"]
  }
}