Scoped Kubeconfigs

Hand a teammate or a CI pipeline least-privilege access to your cluster without sharing admin credentials.

What it does

Kubexer provisions a Kubernetes ServiceAccount with exactly the RBAC you choose, mints a token for it, and assembles a ready-to-use kubeconfig you can download and hand off.

1. Open Access Control → Scoped Kubeconfigs.
2. Choose a preset (e.g. read-only, namespace-admin) or build a custom role.
3. Scope it to specific namespaces.
4. Download the generated kubeconfig.

Safety

• Names are derived from the grant so they're easy to find and revoke later.
• The token is never persisted by Kubexer — it exists only in the downloaded kubeconfig.
• Editing a preset is blocked from escalating its own privileges.
• Revoke a grant at any time to tear down the ServiceAccount and its RBAC.

Notes

Scoped Kubeconfigs is a Pro feature.