Add users with limited rights to a Kubernetes cluster

Creating a namespace-scoped ServiceAccount with a dedicated kubeconfig grants limited cluster access without exposing admin credentials — kubectl and the cluster’s kubeconfig are required. Download the kubeconfig by clicking Kubernetes config on the cluster overview page in the Gcore Customer Portal.

Add users with limited rights

The following procedure creates a ServiceAccount in a dedicated namespace and generates a kubeconfig that authenticates as that ServiceAccount.

1. Create a namespace that will contain both the ServiceAccount and the resources it can access:

kubectl create ns test-namespace

2. Create a service account and a RoleBinding. Replace test-namespace, test-serviceaccount, and test-serviceaccount-rolebinding with the intended names:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-serviceaccount
  namespace: test-namespace
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: test-serviceaccount-rolebinding
  namespace: test-namespace
subjects:
- kind: ServiceAccount
  name: test-serviceaccount
  namespace: test-namespace
roleRef:
  kind: ClusterRole
  name: edit
  apiGroup: rbac.authorization.k8s.io
EOF

3. The ServiceAccount itself cannot be used directly for authentication. Create a token that will be embedded into the kubeconfig in the next step:

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
metadata:
  name: test-serviceaccount-token
  namespace: test-namespace
  annotations:
    kubernetes.io/service-account.name: test-serviceaccount
type: kubernetes.io/service-account-token
EOF

Retrieve the decoded token:

kubectl -n test-namespace get secret test-serviceaccount-token -o jsonpath="{.data.token}" | base64 -d

4. The token from the previous step authenticates the ServiceAccount. Copy the cluster kubeconfig to a new file (do not overwrite the admin kubeconfig), then update it as follows:

• Replace client-certificate-data and client-key-data in users with token: <token-from-step-3>
• Rename the user entry from admin to test-serviceaccount
• Update the user reference in contexts to test-serviceaccount

Before:

After:

5. Switch kubectl to use the new kubeconfig and verify that the assigned permissions behave as expected:

export KUBECONFIG=<path-to-your-new-kubeconfig.yaml>

Test access across the assigned namespace and other namespaces. Operations in the assigned namespace should succeed (S) and operations in other namespaces should fail (F):

If access behaves as expected, the service account and kubeconfig are correctly configured.