{"id":4085,"date":"2025-02-26T16:36:23","date_gmt":"2025-02-26T16:36:23","guid":{"rendered":"https:\/\/code2deploy.com\/blog\/?p=4085"},"modified":"2025-02-21T16:37:47","modified_gmt":"2025-02-21T16:37:47","slug":"preventing-accidental-deployment-deletions-in-kubernetes","status":"publish","type":"post","link":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/","title":{"rendered":"Preventing Accidental Deployment Deletions in Kubernetes"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Accidental deletions of critical Kubernetes deployments can cause downtime and impact application availability. To mitigate this risk, we can use <strong>Role-Based Access Control (RBAC)<\/strong> to restrict permissions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Solution: Implementing RBAC to Restrict Delete Access<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">RBAC allows you to define fine-grained permissions for users and groups, preventing unauthorized actions like deleting deployments.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Creating a Read-Only Role<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This role grants <strong>read-only access<\/strong> to deployments within the <code>production<\/code> namespace.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  namespace: production\n  name: readonly-user\nrules:\n  - apiGroups: &#91;\"apps\"]\n    resources: &#91;\"deployments\"]\n    verbs: &#91;\"get\", \"list\"]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Binding the Role to a User or Group<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Bind the role to a specific user or group to enforce restricted permissions.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: rbac.authorization.k8s.io\/v1\nkind: RoleBinding\nmetadata:\n  namespace: production\n  name: readonly-user-binding\nsubjects:\n  - kind: User\n    name: john.doe   # Replace with the actual user\n    apiGroup: rbac.authorization.k8s.io\nroleRef:\n  kind: Role\n  name: readonly-user\n  apiGroup: rbac.authorization.k8s.io<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Creating a Restricted Role for Developers<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For users who need <strong>update access but not delete access<\/strong>, create a more restrictive role.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: rbac.authorization.k8s.io\/v1\nkind: Role\nmetadata:\n  namespace: production\n  name: restricted-dev\nrules:\n  - apiGroups: &#91;\"apps\"]\n    resources: &#91;\"deployments\"]\n    verbs: &#91;\"get\", \"list\", \"update\"]<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Enforcing Best Practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Use ClusterRoles<\/strong> if you need RBAC rules across multiple namespaces.<\/li>\n\n\n\n<li><strong>Audit RBAC permissions<\/strong> regularly using tools like <code>kubectl auth can-i<\/code>.<\/li>\n\n\n\n<li><strong>Implement Admission Controllers<\/strong> to prevent accidental deletions at the API level.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Alternative Approach: Using an Admission Controller<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Kubernetes admission controllers can enforce policies that prevent deployment deletions. Example using <strong>Gatekeeper with Open Policy Agent (OPA)<\/strong>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apiVersion: constraints.gatekeeper.sh\/v1beta1\nkind: K8sDenyDelete\nmetadata:\n  name: deny-deployment-deletions\nspec:\n  match:\n    kinds:\n      - apiGroups: &#91;\"apps\"]\n        kinds: &#91;\"Deployment\"]<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">By implementing <strong>RBAC<\/strong> and <strong>admission controllers<\/strong>, organizations can prevent accidental deletions, ensuring application stability and security in Kubernetes.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Scenario Accidental deletions of critical Kubernetes deployments can cause downtime and impact application availability. To mitigate this risk, we can use Role-Based Access Control (RBAC) to restrict permissions. Solution: Implementing RBAC to Restrict Delete Access RBAC allows you to define fine-grained permissions for users and groups, preventing unauthorized actions like deleting deployments. Step 1: Creating [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[236,9,216],"tags":[544],"class_list":["post-4085","post","type-post","status-publish","format-standard","hentry","category-k8s-security","category-kubernetes","category-kubernetes-basic","tag-kubernetes-rbac"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Preventing Accidental Deployment Deletions in Kubernetes - code2deploy.com<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Preventing Accidental Deployment Deletions in Kubernetes - code2deploy.com\" \/>\n<meta property=\"og:description\" content=\"Scenario Accidental deletions of critical Kubernetes deployments can cause downtime and impact application availability. To mitigate this risk, we can use Role-Based Access Control (RBAC) to restrict permissions. Solution: Implementing RBAC to Restrict Delete Access RBAC allows you to define fine-grained permissions for users and groups, preventing unauthorized actions like deleting deployments. Step 1: Creating [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/\" \/>\n<meta property=\"og:site_name\" content=\"code2deploy.com\" \/>\n<meta property=\"article:published_time\" content=\"2025-02-26T16:36:23+00:00\" \/>\n<meta name=\"author\" content=\"enam\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"enam\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/\"},\"author\":{\"name\":\"enam\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\"},\"headline\":\"Preventing Accidental Deployment Deletions in Kubernetes\",\"datePublished\":\"2025-02-26T16:36:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/\"},\"wordCount\":192,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\"},\"keywords\":[\"Kubernetes RBAC\"],\"articleSection\":[\"k8s Security\",\"Kubernetes\",\"Kubernetes Basic\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/\",\"url\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/\",\"name\":\"Preventing Accidental Deployment Deletions in Kubernetes - code2deploy.com\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#website\"},\"datePublished\":\"2025-02-26T16:36:23+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/preventing-accidental-deployment-deletions-in-kubernetes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Preventing Accidental Deployment Deletions in Kubernetes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/\",\"name\":\"code2deploy.com\\\/blog\",\"description\":\"TechOps\",\"publisher\":{\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/#\\\/schema\\\/person\\\/e46930c19b999a87f12566fa8357481b\",\"name\":\"enam\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\",\"caption\":\"enam\"},\"logo\":{\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g\"},\"sameAs\":[\"https:\\\/\\\/code2deploy.com\\\/blog\"],\"url\":\"https:\\\/\\\/code2deploy.com\\\/blog\\\/author\\\/enam\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Preventing Accidental Deployment Deletions in Kubernetes - code2deploy.com","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/","og_locale":"en_US","og_type":"article","og_title":"Preventing Accidental Deployment Deletions in Kubernetes - code2deploy.com","og_description":"Scenario Accidental deletions of critical Kubernetes deployments can cause downtime and impact application availability. To mitigate this risk, we can use Role-Based Access Control (RBAC) to restrict permissions. Solution: Implementing RBAC to Restrict Delete Access RBAC allows you to define fine-grained permissions for users and groups, preventing unauthorized actions like deleting deployments. Step 1: Creating [&hellip;]","og_url":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/","og_site_name":"code2deploy.com","article_published_time":"2025-02-26T16:36:23+00:00","author":"enam","twitter_card":"summary_large_image","twitter_misc":{"Written by":"enam","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/#article","isPartOf":{"@id":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/"},"author":{"name":"enam","@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b"},"headline":"Preventing Accidental Deployment Deletions in Kubernetes","datePublished":"2025-02-26T16:36:23+00:00","mainEntityOfPage":{"@id":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/"},"wordCount":192,"commentCount":0,"publisher":{"@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b"},"keywords":["Kubernetes RBAC"],"articleSection":["k8s Security","Kubernetes","Kubernetes Basic"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/","url":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/","name":"Preventing Accidental Deployment Deletions in Kubernetes - code2deploy.com","isPartOf":{"@id":"https:\/\/code2deploy.com\/blog\/#website"},"datePublished":"2025-02-26T16:36:23+00:00","breadcrumb":{"@id":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/code2deploy.com\/blog\/preventing-accidental-deployment-deletions-in-kubernetes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/code2deploy.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Preventing Accidental Deployment Deletions in Kubernetes"}]},{"@type":"WebSite","@id":"https:\/\/code2deploy.com\/blog\/#website","url":"https:\/\/code2deploy.com\/blog\/","name":"code2deploy.com\/blog","description":"TechOps","publisher":{"@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/code2deploy.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/code2deploy.com\/blog\/#\/schema\/person\/e46930c19b999a87f12566fa8357481b","name":"enam","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g","caption":"enam"},"logo":{"@id":"https:\/\/secure.gravatar.com\/avatar\/d864e2f082f4499f8f1b33f004ec166eea77b9e94738553b120b6dca2410f203?s=96&d=mm&r=g"},"sameAs":["https:\/\/code2deploy.com\/blog"],"url":"https:\/\/code2deploy.com\/blog\/author\/enam\/"}]}},"_links":{"self":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts\/4085","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/comments?post=4085"}],"version-history":[{"count":1,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts\/4085\/revisions"}],"predecessor-version":[{"id":4086,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/posts\/4085\/revisions\/4086"}],"wp:attachment":[{"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/media?parent=4085"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/categories?post=4085"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/code2deploy.com\/blog\/wp-json\/wp\/v2\/tags?post=4085"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}