When creating a user with only access to a project, he/she can still delete the cluster under global view.
Is it possible to disable this functionality?
It should not be possible to delete the connection to the kubernetes cluster.
Most of the buttons on the UI are not currently dynamically shown/hidden by RBAC changes because there is not enough information in the API response to tell if e.g. a request to delete this particular cluster would succeed if attempted. The presence of the button does not mean you can actually do it.