<p>I want to give my application limited access to get the replicas of different statefulsets (and maybe deployment) and if necessary scale them up or down.</p>

<p>I have created ServiceAccount, Rolebinding and Role for this but I can't find the complete list of rule verbs ("get", "watch", "list", "update") and what are their limitations, for example can I use <code>update</code> for scaling or I need another verb? And where can I find a list or table that described these verbs?</p>

<p>My yaml file:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: scaler-role
  namespace: {{ .Release.Namespace  | quote }}
rules:
- apiGroups: ["apps"]
  resources: ["statefulset"]
  verbs: ["get", "watch", "list", "update"]
</code></pre>

<p>You can get quite a bit of info via this:</p>
<pre><code>kubectl api-resources --sort-by name -o wide
</code></pre>
<p>The above <code>api-resources</code> command is explicit and easy to grep. The complete list of possible verbs can be obtained thus:</p>
<pre><code>$ kubectl api-resources --no-headers --sort-by name -o wide | sed 's/.*\[//g' | tr -d &quot;]&quot; | tr &quot; &quot; &quot;\n&quot; | sort | uniq
create
delete
deletecollection
get
list
patch
update
watch
</code></pre>
<p>The <em>Resource Operations</em> section of API reference docs (eg <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/</a>) talks a little bit about them but doesn't mention <code>deletecollection</code> (btw: see <a href="https://stackoverflow.com/a/57131185/869951">interesting info about <code>deletecollection</code></a>; suggests that whenever you give <code>delete</code>, you should give <code>deletecollection</code> permission too, if the resource supports it).</p>
<p>The <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb" rel="nofollow noreferrer">Determine the Request Verb</a> section of <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">Authorization Overview</a> does briefly mention <code>deletecollection</code>, as well as a half a dozen more verbs (such as <code>escalate</code> as pointed out rightfully by @RoryMcCune) which, unfortunately, do not show up in output of <code>kubectl api-resources -o wide</code> command.</p>
<p>BTW the <code>api-resources</code> command also lists the short names of commands, such as <code>svc</code> for <code>services</code>.</p>
<h2>Update May 2023:</h2>
<p>Another less user-friendly but more complete way of getting the verbs is by directly querying the API server:</p>
<ol>
<li>in one terminal, start a proxy for the API server; eg <code>kubectl proxy --port=8080</code></li>
<li>in another terminal, use <code>curl</code> on <code>/api/v1</code> and <code>/apis</code></li>
</ol>
<p><strong>For core resources (configmaps, etc):</strong></p>
<p>Use <code>curl -s lo calhost:8080 /api/v1</code> to get json with the verbs for each core resource type name. Eg (if you have <code>jq</code>)</p>
<pre><code>$ curl -s http://localhost:8080/api/v1 | jq '.resources[] | [.name, (.verbs | join(&quot; &quot;))] | join(&quot; = &quot;)' -r
bindings = create
componentstatuses = get list
configmaps = create delete deletecollection get list patch update watch
endpoints = create delete deletecollection get list patch update watch
...
</code></pre>
<p><strong>For the non-core resources (deployments, CRD, etc):</strong></p>
<p>Say you want the verbs for deployments, you know that the API group for deployments is <code>apps</code>. First get the versioned group name for that API using <code>curl -s http://localhost:8080/apis</code>. Eg (if you have <code>jq</code>)</p>
<pre><code>```
$ curl -s http://localhost:8080/apis | jq '.groups[].preferredVersion.groupVersion' -r | grep ^apps
apps/v1
```
</code></pre>
<p>Use this to query the API of that group for verbs by using <code>curl -s http://localhost:8080/apis/VERSIONED_API</code> ie in the above example <code>curl -s http://localhost:8080/apis/apps/v1</code>. Eg (if you have <code>jq</code>, the jq is the same),</p>
<pre><code>```
$ curl -s http://localhost:8080/apis/apps/v1 | jq '.resources[] | [.name, (.verbs | join(&quot; &quot;))] | join(&quot; = &quot;)' -r
controllerrevisions = create delete deletecollection get list patch update watch
daemonsets = create delete deletecollection get list patch update watch
daemonsets/status = get patch update
deployments = create delete deletecollection get list patch update watch
deployments/scale = get patch update
deployments/status = get patch update
...
```
</code></pre>
<p>BTW the page <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/</a> documents how to use Python, Java etc instead of curl.</p>
<p>I created a kubectl plugin, for the use case where one wants to get the verbs for a specific resource type: <a href="https://github.com/schollii/my-devops-lab/blob/main/kubernetes/kubectl-verbs" rel="nofollow noreferrer">https://github.com/schollii/my-devops-lab/blob/main/kubernetes/kubectl-verbs</a>. Eg</p>
<pre><code>$ kubectl verbs configmaps
configmaps = create delete deletecollection get list patch update watch

$ kubectl verbs deployments apps
deployments = create delete deletecollection get list patch update watch
deployments/scale = get patch update
deployments/status = get patch update
</code></pre>
<p>The file has instructions to install it as a plugin. It is a simple bash script.</p>
