RBAC - Access to kubernetes API

user_3317808 0
Viewed 115

In the below manifest yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-operator
rules:
- apiGroups: [apiextensions.k8s.io]
  resources: [customresourcedefinitions]
  verbs: ['*']
- apiGroups: [monitoring.coreos.com]
  resources: 
  - alertmanagers
  - prometheuses
  - prometheuses/finalizers
  - alertmanagers/finalizers
  - servicemonitors
  - prometheusrules
  verbs: ['*']

What does rules with apiGroups signify?

prometheus-operator prometheus kubernetes
1 Answers

In Kubernetes resources can be either grouped resources or individual resources .

Example :

kubectl api-resources  | grep 'crds\|pods\|NAME'
NAME                              SHORTNAMES   APIVERSION                             NAMESPACED   KIND
pods                              po           v1                                     true         Pod
customresourcedefinitions         crd,crds     apiextensions.k8s.io/v1                false        CustomResourceDefinition

In above output , for pods apiVersion is displayed as v1 so it is an individual resource . where as for customresourcedefinitions apiVersion is displayed as apiextensions.k8s.io/v1 which indicates that it is a grouped resource under the group apiextensions.k8s.io.

When we are defining RBAC rules (roles/clusreroles) for grouped resources we need to mention apiGroups along with resources.

user_36380810
Related