<p dir="auto">I created policy.jsonl</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="{&quot;user&quot;:&quot;alice&quot;, &quot;namespace&quot;: &quot;projectCaribou&quot;}"><pre class="notranslate"><code class="notranslate">{"user":"alice", "namespace": "projectCaribou"}
</code></pre></div>
<p dir="auto">And I tried to get pods by kubectl.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ kubectl get po --username=alice --password=password --server=https://localhost:6443 --insecure-skip-tls-verify=true
error: couldn't read version from server: the server does not allow access to the requested resource"><pre class="notranslate"><code class="notranslate">$ kubectl get po --username=alice --password=password --server=https://localhost:6443 --insecure-skip-tls-verify=true
error: couldn't read version from server: the server does not allow access to the requested resource
</code></pre></div>
<p dir="auto">At first, kubectl seems to access <a href="https://localhost:6443/api/" rel="nofollow">https://localhost:6443/api/</a> and fail because the "alice" can only have access on <a href="https://localhost:6443/api/v1/namespaces/projectCaribou" rel="nofollow">https://localhost:6443/api/v1/namespaces/projectCaribou</a>.</p>
<h3 dir="auto">what I have</h3>
<p dir="auto"><em>kube cluster version:</em></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="./kube-apiserver --version 
Kubernetes v1.0.0-1057-ged9975b0310eaf"><pre class="notranslate"><code class="notranslate">./kube-apiserver --version 
Kubernetes v1.0.0-1057-ged9975b0310eaf
</code></pre></div>
<p dir="auto"><em>auth_policy.json:</em></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="{&quot;user&quot;:&quot;admin&quot;}
{&quot;user&quot;:&quot;monitoring&quot;, &quot;readonly&quot;: true}
{&quot;user&quot;:&quot;scheduler&quot;, &quot;readonly&quot;: true, &quot;resource&quot;: &quot;pods&quot;}
{&quot;user&quot;:&quot;scheduler&quot;, &quot;resource&quot;: &quot;bindings&quot;}
{&quot;user&quot;:&quot;kubelet&quot;,  &quot;readonly&quot;: true, &quot;resource&quot;: &quot;pods&quot;}
{&quot;user&quot;:&quot;kubelet&quot;,  &quot;readonly&quot;: true, &quot;resource&quot;: &quot;services&quot;}
{&quot;user&quot;:&quot;kubelet&quot;,  &quot;readonly&quot;: true, &quot;resource&quot;: &quot;endpoints&quot;}
{&quot;user&quot;:&quot;kubelet&quot;, &quot;resource&quot;: &quot;events&quot;}
{&quot;user&quot;:&quot;discover&quot;, &quot;ns&quot;: &quot;discover&quot;}"><pre class="notranslate"><code class="notranslate">{"user":"admin"}
{"user":"monitoring", "readonly": true}
{"user":"scheduler", "readonly": true, "resource": "pods"}
{"user":"scheduler", "resource": "bindings"}
{"user":"kubelet",  "readonly": true, "resource": "pods"}
{"user":"kubelet",  "readonly": true, "resource": "services"}
{"user":"kubelet",  "readonly": true, "resource": "endpoints"}
{"user":"kubelet", "resource": "events"}
{"user":"discover", "ns": "discover"}
</code></pre></div>
<p dir="auto"><em>kube-apiserver startup parameteres:</em></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="/usr/local/bin/kube-apiserver --address=0.0.0.0 --admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota --service-cluster-ip-range=10.116.0.0/23 --client_ca_file=/srv/kubernetes/ca.crt --basic_auth_file=/srv/kubernetes/basic_auth.csv --authorization-mode=ABAC --authorization-policy-file=/srv/kubernetes/auth_policy.json --tls_cert_file=/srv/kubernetes/server.cert --tls_private_key_file=/srv/kubernetes/server.key --secure_port=6443 --token_auth_file=/srv/kubernetes/known_tokens.csv --v=2 --cors_allowed_origins=.* --etcd-config=/etc/kubernetes/etcd.config --allow_privileged=False"><pre class="notranslate"><code class="notranslate">/usr/local/bin/kube-apiserver --address=0.0.0.0 --admission_control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ServiceAccount,ResourceQuota --service-cluster-ip-range=10.116.0.0/23 --client_ca_file=/srv/kubernetes/ca.crt --basic_auth_file=/srv/kubernetes/basic_auth.csv --authorization-mode=ABAC --authorization-policy-file=/srv/kubernetes/auth_policy.json --tls_cert_file=/srv/kubernetes/server.cert --tls_private_key_file=/srv/kubernetes/server.key --secure_port=6443 --token_auth_file=/srv/kubernetes/known_tokens.csv --v=2 --cors_allowed_origins=.* --etcd-config=/etc/kubernetes/etcd.config --allow_privileged=False
</code></pre></div>
<p dir="auto"><em>token authorization in known_tokens.csv</em></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ,discover,discover"><pre class="notranslate"><code class="notranslate">72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ,discover,discover
</code></pre></div>
<p dir="auto">_kubeconfig for kubectl: cat .kube/config _</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: &quot;https://10.116.0.1&quot;
  name: local
contexts:
- context:
    cluster: local
    user: discover
    namespace: discover
  name: discover
current-context: discover
kind: Config
preferences: {}
users:
- name: discover
  user:
    token: 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ"><pre class="notranslate"><code class="notranslate">apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: "https://10.116.0.1"
  name: local
contexts:
- context:
    cluster: local
    user: discover
    namespace: discover
  name: discover
current-context: discover
kind: Config
preferences: {}
users:
- name: discover
  user:
    token: 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ
</code></pre></div>
<h3 dir="auto">what I do</h3>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="kubectl get namespaces
NAME                  LABELS    STATUS
default               &lt;none&gt;    Active
infra                 &lt;none&gt;    Active
kube-system           &lt;none&gt;    Active
objects               &lt;none&gt;    Active

~$ kubectl --namespace=infra get rc
CONTROLLER           CONTAINER(S)      IMAGE(S)                 SELECTOR                             REPLICAS
docker-registry-v1   docker-registry   registry:2.0.0           k8s-app=docker-registry,version=v1   1
zabbix-proxy-v1      zabbix-proxy      otechlabs/zabbix_proxy   k8s-app=zabbix-proxy,version=v1      1

~$ kubectl --namespace=infra get  po
NAME                       READY     STATUS    RESTARTS   AGE
docker-registry-v1-u7nvo   0/1       Pending   0          20m
zabbix-proxy-v1-xnsep      0/1       Pending   0          20m

~$ kubectl --namespace=infra delete po zabbix-proxy-v1-xnsep
pod &quot;zabbix-proxy-v1-xnsep&quot; deleted

~$ kubectl --namespace=infra get  po
NAME                       READY     STATUS    RESTARTS   AGE
docker-registry-v1-u7nvo   0/1       Pending   0          21m
zabbix-proxy-v1-pavzv      0/1       Pending   0          -30s

~$ kubectl --v=10 --namespace=infra get  rc
I0731 21:14:46.401721     257 debugging.go:101] curl -k -v -XGET  -H &quot;User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b&quot; -H &quot;Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ&quot; https://10.116.0.1/api
I0731 21:14:46.468688     257 debugging.go:120] GET https://10.116.0.1/api 200 OK in 66 milliseconds
I0731 21:14:46.468724     257 debugging.go:126] Response Headers:
I0731 21:14:46.468736     257 debugging.go:129]     Content-Type: application/json
I0731 21:14:46.468748     257 debugging.go:129]     Date: Fri, 31 Jul 2015 21:15:42 GMT
I0731 21:14:46.468759     257 debugging.go:129]     Content-Length: 32
I0731 21:14:46.468792     257 request.go:748] Response Body: {
  &quot;versions&quot;: [
    &quot;v1&quot;
  ]
}
I0731 21:14:46.469095     257 debugging.go:101] curl -k -v -XGET  -H &quot;User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b&quot; -H &quot;Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ&quot; https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers
I0731 21:14:46.530797     257 debugging.go:120] GET https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers 200 OK in 61 milliseconds
I0731 21:14:46.530831     257 debugging.go:126] Response Headers:
I0731 21:14:46.530844     257 debugging.go:129]     Content-Type: application/json
I0731 21:14:46.530856     257 debugging.go:129]     Date: Fri, 31 Jul 2015 21:15:42 GMT
I0731 21:14:46.530912     257 request.go:748] Response Body: {&quot;kind&quot;:&quot;ReplicationControllerList&quot;,&quot;apiVersion&quot;:&quot;v1&quot;,&quot;metadata&quot;:{&quot;selfLink&quot;:&quot;/api/v1/namespaces/infra/replicationcontrollers&quot;,&quot;resourceVersion&quot;:&quot;10119186&quot;},&quot;items&quot;:[{&quot;metadata&quot;:{&quot;name&quot;:&quot;docker-registry-v1&quot;,&quot;namespace&quot;:&quot;infra&quot;,&quot;selfLink&quot;:&quot;/api/v1/namespaces/infra/replicationcontrollers/docker-registry-v1&quot;,&quot;uid&quot;:&quot;51b1c5f1-1fd3-11e5-a2d1-b083fec18c38&quot;,&quot;resourceVersion&quot;:&quot;10109207&quot;,&quot;creationTimestamp&quot;:&quot;2015-07-01T09:26:57Z&quot;,&quot;labels&quot;:{&quot;k8s-app&quot;:&quot;docker-registry-v1&quot;,&quot;sc01p-service&quot;:&quot;true&quot;}},&quot;spec&quot;:{&quot;replicas&quot;:1,&quot;selector&quot;:{&quot;k8s-app&quot;:&quot;docker-registry&quot;,&quot;version&quot;:&quot;v1&quot;},&quot;template&quot;:{&quot;metadata&quot;:{&quot;creationTimestamp&quot;:null,&quot;labels&quot;:{&quot;k8s-app&quot;:&quot;docker-registry&quot;,&quot;sc01p-service&quot;:&quot;true&quot;,&quot;version&quot;:&quot;v1&quot;}},&quot;spec&quot;:{&quot;volumes&quot;:[{&quot;name&quot;:&quot;docker-images-storage&quot;,&quot;hostPath&quot;:{&quot;path&quot;:&quot;/var/persistent_data/infra/docker-registry&quot;}}],&quot;containers&quot;:[{&quot;name&quot;:&quot;docker-registry&quot;,&quot;image&quot;:&quot;registry:2.0.0&quot;,&quot;ports&quot;:[{&quot;name&quot;:&quot;docker-registry&quot;,&quot;containerPort&quot;:5000,&quot;protocol&quot;:&quot;TCP&quot;}],&quot;env&quot;:[{&quot;name&quot;:&quot;REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY&quot;,&quot;value&quot;:&quot;/var/lib/registry&quot;}],&quot;resources&quot;:{},&quot;volumeMounts&quot;:[{&quot;name&quot;:&quot;docker-images-storage&quot;,&quot;mountPath&quot;:&quot;/var/lib/registry&quot;}],&quot;livenessProbe&quot;:{&quot;tcpSocket&quot;:{&quot;port&quot;:5000},&quot;initialDelaySeconds&quot;:30,&quot;timeoutSeconds&quot;:5},&quot;terminationMessagePath&quot;:&quot;/dev/termination-log&quot;,&quot;imagePullPolicy&quot;:&quot;IfNotPresent&quot;}],&quot;restartPolicy&quot;:&quot;Always&quot;,&quot;dnsPolicy&quot;:&quot;Default&quot;,&quot;nodeSelector&quot;:{&quot;zone&quot;:&quot;common&quot;}}}},&quot;status&quot;:{&quot;replicas&quot;:1}},{&quot;metadata&quot;:{&quot;name&quot;:&quot;zabbix-proxy-v1&quot;,&quot;namespace&quot;:&quot;infra&quot;,&quot;selfLink&quot;:&quot;/api/v1/namespaces/infra/replicationcontrollers/zabbix-proxy-v1&quot;,&quot;uid&quot;:&quot;0f383d9a-1fcb-11e5-a2d1-b083fec18c38&quot;,&quot;resourceVersion&quot;:&quot;10116339&quot;,&quot;creationTimestamp&quot;:&quot;2015-07-01T08:27:49Z&quot;,&quot;labels&quot;:{&quot;k8s-app&quot;:&quot;zabbix-proxy-v1&quot;,&quot;sc01p-service&quot;:&quot;true&quot;}},&quot;spec&quot;:{&quot;replicas&quot;:1,&quot;selector&quot;:{&quot;k8s-app&quot;:&quot;zabbix-proxy&quot;,&quot;version&quot;:&quot;v1&quot;},&quot;template&quot;:{&quot;metadata&quot;:{&quot;creationTimestamp&quot;:null,&quot;labels&quot;:{&quot;k8s-app&quot;:&quot;zabbix-proxy&quot;,&quot;sc01p-service&quot;:&quot;true&quot;,&quot;version&quot;:&quot;v1&quot;}},&quot;spec&quot;:{&quot;volumes&quot;:[{&quot;name&quot;:&quot;zabbix-proxy-config&quot;,&quot;secret&quot;:{&quot;secretName&quot;:&quot;zabbix-proxy-config&quot;}}],&quot;containers&quot;:[{&quot;name&quot;:&quot;zabbix-proxy&quot;,&quot;image&quot;:&quot;otechlabs/zabbix_proxy&quot;,&quot;args&quot;:[&quot;/usr/local/bin/bg2fg&quot;,&quot;-c&quot;,&quot;/usr/sbin/zabbix_proxy -c /opt/zabbix/zabbix-proxy.conf&quot;,&quot;-p&quot;,&quot;/var/run/zabbix/zabbix_proxy.pid&quot;],&quot;ports&quot;:[{&quot;name&quot;:&quot;zabbix-proxy&quot;,&quot;containerPort&quot;:10051,&quot;protocol&quot;:&quot;TCP&quot;}],&quot;resources&quot;:{},&quot;volumeMounts&quot;:[{&quot;name&quot;:&quot;zabbix-proxy-config&quot;,&quot;readOnly&quot;:true,&quot;mountPath&quot;:&quot;/opt/zabbix/&quot;}],&quot;livenessProbe&quot;:{&quot;tcpSocket&quot;:{&quot;port&quot;:10051},&quot;initialDelaySeconds&quot;:30,&quot;timeoutSeconds&quot;:5},&quot;terminationMessagePath&quot;:&quot;/dev/termination-log&quot;,&quot;imagePullPolicy&quot;:&quot;IfNotPresent&quot;}],&quot;restartPolicy&quot;:&quot;Always&quot;,&quot;dnsPolicy&quot;:&quot;Default&quot;,&quot;nodeSelector&quot;:{&quot;zone&quot;:&quot;common&quot;}}}},&quot;status&quot;:{&quot;replicas&quot;:1}}]}
CONTROLLER           CONTAINER(S)      IMAGE(S)                 SELECTOR                             REPLICAS
docker-registry-v1   docker-registry   registry:2.0.0           k8s-app=docker-registry,version=v1   1
zabbix-proxy-v1      zabbix-proxy      otechlabs/zabbix_proxy   k8s-app=zabbix-proxy,version=v1      1"><pre class="notranslate"><code class="notranslate">kubectl get namespaces
NAME                  LABELS    STATUS
default               &lt;none&gt;    Active
infra                 &lt;none&gt;    Active
kube-system           &lt;none&gt;    Active
objects               &lt;none&gt;    Active

~$ kubectl --namespace=infra get rc
CONTROLLER           CONTAINER(S)      IMAGE(S)                 SELECTOR                             REPLICAS
docker-registry-v1   docker-registry   registry:2.0.0           k8s-app=docker-registry,version=v1   1
zabbix-proxy-v1      zabbix-proxy      otechlabs/zabbix_proxy   k8s-app=zabbix-proxy,version=v1      1

~$ kubectl --namespace=infra get  po
NAME                       READY     STATUS    RESTARTS   AGE
docker-registry-v1-u7nvo   0/1       Pending   0          20m
zabbix-proxy-v1-xnsep      0/1       Pending   0          20m

~$ kubectl --namespace=infra delete po zabbix-proxy-v1-xnsep
pod "zabbix-proxy-v1-xnsep" deleted

~$ kubectl --namespace=infra get  po
NAME                       READY     STATUS    RESTARTS   AGE
docker-registry-v1-u7nvo   0/1       Pending   0          21m
zabbix-proxy-v1-pavzv      0/1       Pending   0          -30s

~$ kubectl --v=10 --namespace=infra get  rc
I0731 21:14:46.401721     257 debugging.go:101] curl -k -v -XGET  -H "User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b" -H "Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ" https://10.116.0.1/api
I0731 21:14:46.468688     257 debugging.go:120] GET https://10.116.0.1/api 200 OK in 66 milliseconds
I0731 21:14:46.468724     257 debugging.go:126] Response Headers:
I0731 21:14:46.468736     257 debugging.go:129]     Content-Type: application/json
I0731 21:14:46.468748     257 debugging.go:129]     Date: Fri, 31 Jul 2015 21:15:42 GMT
I0731 21:14:46.468759     257 debugging.go:129]     Content-Length: 32
I0731 21:14:46.468792     257 request.go:748] Response Body: {
  "versions": [
    "v1"
  ]
}
I0731 21:14:46.469095     257 debugging.go:101] curl -k -v -XGET  -H "User-Agent: kubectl/v1.0.0 (linux/amd64) kubernetes/ed9975b" -H "Authorization: Bearer 72STd5Ljfr16aDO7nS3jvh30Rs0FYlHQ" https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers
I0731 21:14:46.530797     257 debugging.go:120] GET https://10.116.0.1/api/v1/namespaces/infra/replicationcontrollers 200 OK in 61 milliseconds
I0731 21:14:46.530831     257 debugging.go:126] Response Headers:
I0731 21:14:46.530844     257 debugging.go:129]     Content-Type: application/json
I0731 21:14:46.530856     257 debugging.go:129]     Date: Fri, 31 Jul 2015 21:15:42 GMT
I0731 21:14:46.530912     257 request.go:748] Response Body: {"kind":"ReplicationControllerList","apiVersion":"v1","metadata":{"selfLink":"/api/v1/namespaces/infra/replicationcontrollers","resourceVersion":"10119186"},"items":[{"metadata":{"name":"docker-registry-v1","namespace":"infra","selfLink":"/api/v1/namespaces/infra/replicationcontrollers/docker-registry-v1","uid":"51b1c5f1-1fd3-11e5-a2d1-b083fec18c38","resourceVersion":"10109207","creationTimestamp":"2015-07-01T09:26:57Z","labels":{"k8s-app":"docker-registry-v1","sc01p-service":"true"}},"spec":{"replicas":1,"selector":{"k8s-app":"docker-registry","version":"v1"},"template":{"metadata":{"creationTimestamp":null,"labels":{"k8s-app":"docker-registry","sc01p-service":"true","version":"v1"}},"spec":{"volumes":[{"name":"docker-images-storage","hostPath":{"path":"/var/persistent_data/infra/docker-registry"}}],"containers":[{"name":"docker-registry","image":"registry:2.0.0","ports":[{"name":"docker-registry","containerPort":5000,"protocol":"TCP"}],"env":[{"name":"REGISTRY_STORAGE_FILESYSTEM_ROOTDIRECTORY","value":"/var/lib/registry"}],"resources":{},"volumeMounts":[{"name":"docker-images-storage","mountPath":"/var/lib/registry"}],"livenessProbe":{"tcpSocket":{"port":5000},"initialDelaySeconds":30,"timeoutSeconds":5},"terminationMessagePath":"/dev/termination-log","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","dnsPolicy":"Default","nodeSelector":{"zone":"common"}}}},"status":{"replicas":1}},{"metadata":{"name":"zabbix-proxy-v1","namespace":"infra","selfLink":"/api/v1/namespaces/infra/replicationcontrollers/zabbix-proxy-v1","uid":"0f383d9a-1fcb-11e5-a2d1-b083fec18c38","resourceVersion":"10116339","creationTimestamp":"2015-07-01T08:27:49Z","labels":{"k8s-app":"zabbix-proxy-v1","sc01p-service":"true"}},"spec":{"replicas":1,"selector":{"k8s-app":"zabbix-proxy","version":"v1"},"template":{"metadata":{"creationTimestamp":null,"labels":{"k8s-app":"zabbix-proxy","sc01p-service":"true","version":"v1"}},"spec":{"volumes":[{"name":"zabbix-proxy-config","secret":{"secretName":"zabbix-proxy-config"}}],"containers":[{"name":"zabbix-proxy","image":"otechlabs/zabbix_proxy","args":["/usr/local/bin/bg2fg","-c","/usr/sbin/zabbix_proxy -c /opt/zabbix/zabbix-proxy.conf","-p","/var/run/zabbix/zabbix_proxy.pid"],"ports":[{"name":"zabbix-proxy","containerPort":10051,"protocol":"TCP"}],"resources":{},"volumeMounts":[{"name":"zabbix-proxy-config","readOnly":true,"mountPath":"/opt/zabbix/"}],"livenessProbe":{"tcpSocket":{"port":10051},"initialDelaySeconds":30,"timeoutSeconds":5},"terminationMessagePath":"/dev/termination-log","imagePullPolicy":"IfNotPresent"}],"restartPolicy":"Always","dnsPolicy":"Default","nodeSelector":{"zone":"common"}}}},"status":{"replicas":1}}]}
CONTROLLER           CONTAINER(S)      IMAGE(S)                 SELECTOR                             REPLICAS
docker-registry-v1   docker-registry   registry:2.0.0           k8s-app=docker-registry,version=v1   1
zabbix-proxy-v1      zabbix-proxy      otechlabs/zabbix_proxy   k8s-app=zabbix-proxy,version=v1      1
</code></pre></div>
<h3 dir="auto">expected result</h3>
<p dir="auto">I expected to get forbidden error instead of deleting pod/rc or any other object, I would like to also forbid namespaces listing for the user. In current state it has no difference with AlwaysAllow mode.</p>