Verbs and resources

Learn RBAC verbs and resources.

Verbs and resources

The verbs in rules correspond to HTTP requests:

Reading: get (one), list (many), watch (follow)
Writing: create, update, patch, delete, deletecollection

Subresources need separate permissions: pods/log (reading logs), pods/exec (exec), deployments/scale (scaling). resourceNames limits the permission to specific objects:

rules:
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/scale"]
    resourceNames: ["web"]
    verbs: ["get", "patch", "update"]

Avoid wildcards

"*" covers all resources or verbs and also includes resources added in the future. Following the principle of least privilege, permissions are listed explicitly. Reading Secrets, pods/exec and modifying RBAC objects (escalate, bind) in particular are granted with care:

# avoid
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]
# prefer
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]

Exercise A role that scales only web

Write a Role YAML: name web-olcekleyici, namespace dev; a single rule: apiGroups: ["apps"], resources: ["deployments", "deployments/scale"], resourceNames: ["web"], verbs: ["get", "patch", "update"].

Show example solution

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: web-olcekleyici
  namespace: dev
rules:
  - apiGroups: ["apps"]
    resources: ["deployments", "deployments/scale"]
    resourceNames: ["web"]
    verbs: ["get", "patch", "update"]

Test yourself

Can someone with get permission on pods run kubectl exec?
- It opens a read-only shell
- No; create permission on the pods/exec subresource is needed
- Yes
- Only on their own pods
Show answer

No; create permission on the pods/exec subresource is needed — exec and port-forward are powerful permissions; they are granted separately.

Limit the permission to a specific object.

    resources: ["deployments"]
    ____: ["web"]

Show answer

    resources: ["deployments"]
    resourceNames: ["web"]

Match the verbs.

get

Read one object
list

Read many objects
watch

Watch changes
patch

Partially change

Next lesson: Summary - RBAC

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies