<p>I am trying to allow some users in my org to forward ports to our production namespace in Kubernetes. However, I don't want them to be able to forward ports to all services. I want to restrict access to only certain services. Is this possible?</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: allow-port-forward-for-deployment-a
rules:
- apiGroups: [""]
  resources: ["pods/portforward"]
  verbs: ["get", "list", "create"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: allow-port-forward-for-deployment-a
  namespace: production
subjects:
- kind: User
  name: "xyz@org.com"
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: allow-port-forward-for-deployment-a
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>The above set up allows all services, but I don't want that.</p>

<p>I believe you can't. <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources" rel="noreferrer">According to the docs</a></p>

<blockquote>
  <p>Resources can also be referred to by name for certain requests through
  the <code>resourceNames</code> list. When specified, requests can be restricted to
  individual instances of a resource. To restrict a subject to only
  “get” and “update” a single configmap, you would write:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: configmap-updater
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  resourceNames: ["my-configmap"]
  verbs: ["update", "get"]
</code></pre>
  
  <p><strong>Note that create requests
  cannot be restricted by resourceName, as the object name is not known
  at authorization time. The other exception is deletecollection.</strong></p>
</blockquote>

<p>Since you want to give the user permissions to <strong>create</strong> the forward ports, I don't think you can.</p>
