Restricted admin

[kamantauskasrokas-dot]

Hello,
is there any way to make restricted admin role, i want to deny editing some users for certain admins, i am trying something like this, but it doest work

GNU nano 7.2 user-manager.yaml *
kind: role
metadata:
name: user-manager
spec:
allow:
rules:
- resources: ["user"]
verbs: ["list", "create", "read", "update"]

  - resources: ["role"]
    verbs: ["list", "read"]

deny:
rules:
- resources: ["user"]
verbs: ["update", "delete"]
where: 'user.metadata.name == "username"'
version: v7

[stevenGravy]

The where filtering is not available for all resource rules. user is not one of them. You may want to look at using access requests to limit when a user does update and delete so it is confirmed by another user.