<p>When defining a <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/" rel="noreferrer">ServiceAccount</a>, you tell Kubernetes which apiGroups, resources, and verbs you want to give access to.:</p>

<pre><code>apiVersion: v1
kind: ServiceAccount
...
kind: Role
rules:
- apiGroups: [""]
  resources: ["pods", "pods/exec", "persistentvolumeclaims", "services"]
  verbs: ["get", "watch", "list", "create", "update", "patch", "delete", "deletecollection"]
</code></pre>

<p><em>Where can you find the full list of options?</em></p>

<p>Runinng <code>kubectl api-resources -o wide</code> gives many of them, but does not return subresources like <code>pods/exec</code> or <code>pods/log</code>.</p>

<p>Simply execute:</p>

<pre><code>kubectl api-resources --verbs=list --namespaced -o name \
  | xargs -n 1 kubectl get --show-kind --ignore-not-found -l &lt;label&gt;=&lt;value&gt; -n &lt;namespace&gt;
</code></pre>

<p>The <a href="https://shapeshed.com/unix-xargs/" rel="nofollow noreferrer">xargs</a> command in UNIX is a command line utility for building an execution pipeline from standard input. Whilst tools like grep can accept standard input as a parameter, many other tools cannot. Using xargs allows tools like echo and rm and mkdir to accept standard input as arguments.</p>

<p>To fetch the logs, use the kubectl logs command, as follows:</p>

<pre><code>kubectl logs your-pod-name -n namespace-name
</code></pre>

<p>Sub-resources and verbs that you need to define <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> roles are not documented anywhere in a static list.  They are available in the discovery documentation, i.e. via the API, e.g. <code>/api/apps/v1</code>.</p>

<p>The following bash script will list all the resources, sub-resources and verbs in the following format:</p>

<pre><code>api_version resource: [verb]
</code></pre>

<p>where <code>api-version</code> is <code>core</code> for the core resources and should be replaced by <code>""</code> (an empty quoted string) in your role definition.</p>

<p>For example, <code>core pods/status: get patch update</code>.</p>

<p>The script requires [jq][1].</p>

<pre><code>#!/bin/bash
SERVER="localhost:8080"

APIS=$(curl -s $SERVER/apis | jq -r '[.groups | .[].name] | join(" ")')

# do core resources first, which are at a separate api location
api="core"
curl -s $SERVER/api/v1 | jq -r --arg api "$api" '.resources | .[] | "\($api) \(.name): \(.verbs | join(" "))"'

# now do non-core resources
for api in $APIS; do
    version=$(curl -s $SERVER/apis/$api | jq -r '.preferredVersion.version')
    curl -s $SERVER/apis/$api/$version | jq -r --arg api "$api" '.resources | .[]? | "\($api) \(.name): \(.verbs | join(" "))"'
done
</code></pre>

<p>Note that where no verbs are listed via the api, the output will just show the api version and the resource, e.g.</p>

<pre><code>core pods/exec:
</code></pre>

<p>In the specific instance of the following resources unfortunately no verbs are shown via the api.</p>

<pre><code>nodes/proxy
pods/attach
pods/exec
pods/portforward
pods/proxy
services/proxy
</code></pre>

<p>The supported verbs for these resources are as follows:</p>

<pre><code>nodes/proxy: create delete get patch update
pods/attach: create get
pods/exec: create get
pods/portforward: create get
pods/proxy: create delete get patch update
services/proxy: create delete get patch update
</code></pre>

<p>Documentation about logging: <a href="https://kubernetes.io/docs/concepts/cluster-administration/logging/" rel="nofollow noreferrer">kubernetes-logging</a>.</p>

<p>More information you can find here: <a href="http://matthieure.me/2019/06/18/kubernetes-api-resources.html" rel="nofollow noreferrer">api-resources</a>.</p>

<p>Useful blog: <a href="https://medium.com/faun/kubectl-commands-cheatsheet-43ce8f13adfb" rel="nofollow noreferrer">kubectl-cheat-sheet</a>.</p>
