<p>What is the difference between the <code>get</code> and <code>list</code> RBAC verbs? </p>

<p>All I could find in the the documentation is this: 
"get (for individual resources), list (for collections, including full object content)", which I find severely lacking. Is <code>list</code> a superset of <code>get</code>, meaning if you have <code>list</code> permissions can you fetch all the information from <code>get</code> and more? While we're at it, what about <code>watch</code>? Does it only give permissions to read the change stream but not full object? </p>

<p>In practice, you can get all of the information you'd normally get out of <code>get</code> calls through <code>list</code> calls. However, having permission to <code>list</code> a resource doesn't mean <code>get</code> calls will work. You still have to use <code>list</code> calls and extract the information that way.</p>

<p><code>watch</code> is a special verb that gives you permission to see updates on resources in real time. Having <code>watch</code> access without <code>list</code> or <code>get</code> is not very helpful because you won't be able to view the resource after it updates. Through <code>kubectl</code>, I was unable to watch a resource without having the <code>get</code> access to that resource.</p>

<p>To play around with these roles, I'd recommend messing around with roles in a Kubernetes cluster on <a href="https://www.katacoda.com/" rel="noreferrer">Katacoda</a>.</p>

<p>Initial setup to make roles and grant them to (fake) users:</p>

<pre class="lang-sh prettyprint-override"><code>kubectl create role deployment-getter --verb=get --resource=deployment
kubectl create role deployment-lister --verb=list --resource=deployment
kubectl create role deployment-watcher --verb=watch --resource=deployment

kubectl create rolebinding only-get --role=deployment-getter --user=only-get
kubectl create rolebinding only-list --role=deployment-lister--user=only-list
kubectl create rolebinding only-watch --role=deployment-watcher--user=only-list

kubectl run nginx --image=nginx # Make a resource to look at
</code></pre>

<p>Then you can <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation" rel="noreferrer">run <code>kubectl</code> commands as one of the special users</a> to see what limited RBAC permissions look like.</p>

<p>For example, the following commands show that we can only list resources with the <code>list</code> verb.</p>

<pre><code>kubectl get deployment --as list-only # Prints out nginx deployment
kubectl get deployment --as get-only # RBAC error
kubectl get deployment --as watch-only # RBAC error
</code></pre>

<p>And this example shows that we can only get resources with the <code>get</code> verb (but you can get similar information by listing resources too).</p>

<pre><code>kubectl get deployment nginx --as get-only -o yaml
# apiVersion: extensions/v1beta1
# kind: Deployment
# ...
kubectl get deployment nginx --as list-only -o yaml # RBAC error
kubectl get deployment --as list-only -o yaml
# apiVersion: v1
# kind: List
# items:
# - apiVersion: extensions/v1beta1
#   kind: Deployment
#   ...
</code></pre>
