Verbs and resources
- Docker & Kubernetes course
- Advanced
- Lesson 47/70
- 4 min
Learn RBAC verbs and resources.
Verbs and resources
The verbs in rules correspond to HTTP requests:
- Reading:
get(one),list(many),watch(follow) - Writing:
create,update,patch,delete,deletecollection
Subresources need separate permissions: pods/log (reading logs), pods/exec (exec), deployments/scale (scaling). resourceNames limits the permission to specific objects:
rules:
- apiGroups: ["apps"]
resources: ["deployments", "deployments/scale"]
resourceNames: ["web"]
verbs: ["get", "patch", "update"]Avoid wildcards
"*" covers all resources or verbs and also includes resources added in the future. Following the principle of least privilege, permissions are listed explicitly. Reading Secrets, pods/exec and modifying RBAC objects (escalate, bind) in particular are granted with care:
# avoid
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
# prefer
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list"]Practice A role that scales only web
Write a Role YAML: name web-olcekleyici, namespace dev; a single rule: apiGroups: ["apps"], resources: ["deployments", "deployments/scale"], resourceNames: ["web"], verbs: ["get", "patch", "update"].
Starter code
# buraya yazSample solution
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: web-olcekleyici
namespace: dev
rules:
- apiGroups: ["apps"]
resources: ["deployments", "deployments/scale"]
resourceNames: ["web"]
verbs: ["get", "patch", "update"]Expected output
role.rbac.authorization.k8s.io/web-olcekleyici created
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 Can someone with get permission on pods run kubectl exec?
- It opens a read-only shell
- No; create permission on the pods/exec subresource is needed Correct answer
- Yes
- Only on their own pods
Explanation: exec and port-forward are powerful permissions; they are granted separately.
2 Limit the permission to a specific object.
resources: ["deployments"]
____: ["web"] resources: ["deployments"]
resourceNames: ["web"]Explanation: resourceNames covers only the named objects.
3 Match the verbs.
| Term | Meaning |
|---|---|
get |
Read one object |
list |
Read many objects |
watch |
Watch changes |
patch |
Partially change |