Permanent template resources about kiosk

[LukasGentele]

@d-m you can use regular RBAC for this. In the spec.space.clusterRole of every Account (see "Deletable Spaces" example in the readme). You can define the ClusterRole that kiosk uses to create the RoleBinding for the user to be able to manage resources in the namespaces created with this account. You can copy the kiosk default ClusterRole and change it so that users will not be able to manipulate NetworkPolicies.

Does that solve your issue?

[d-m]

Unfortunately no. We still want tenants to be able to manage their own NetworkPolicy objects since some need to be able to manage egress for their applications. I think we may end up looking at different SDN options for tenant isolation.

[FabianKramm]

@d-m you can still allow everything besides deleting NetworkPolicies via RBAC, but I guess in your case it would make sense to look at something like gatekeeper or kyverno that allow you to define custom policies who can delete what in addition to what kiosk does.

[FabianKramm]

I'm closing this issue, since policies are not in the scope of kiosk and there are already other projects covering this.