Comment by robertlagrant

This seems good, but can it also be done via ACLs in vanilla Kubernetes?