<p>I found on microsoft documentation a yaml that consent to do everything in all resources inside a namespace. I modified this yaml to avoid delete verbs and it works fine:</p>
<pre><code>    kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: myaksrole_useraccess
  namespace: mynamespace
rules:
- apiGroups: [&quot;&quot;, &quot;extensions&quot;, &quot;apps&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;create&quot;, &quot;patch&quot;, &quot;get&quot;, &quot;update&quot;, &quot;list&quot;]
- apiGroups: [&quot;batch&quot;]
  resources:
  - jobs
  - cronjobs
  verbs: [&quot;create&quot;, &quot;patch&quot;, &quot;get&quot;, &quot;update&quot;, &quot;list&quot;]
</code></pre>
<p>My question is: How I can add delete only for pods resources in this yaml?</p>

<p>Let's check the <code>myaksrole_useraccess</code> Role from the original definition:</p>
<pre><code>kubectl describe role myaksrole_useraccess -n mynamespace
Name:         myaksrole_useraccess
kind: Role
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
PolicyRule:
  Resources       Non-Resource URLs  Resource Names  Verbs
  ---------       -----------------  --------------  -----
  *               []                 []              [create patch get update list]
  *.apps          []                 []              [create patch get update list]
  cronjobs.batch  []                 []              [create patch get update list]
  jobs.batch      []                 []              [create patch get update list]
  *.extensions    []                 []              [create patch get update list]
</code></pre>
<p>Then we can add additional permission for the Pods resource. The updated Role definition is shown below.</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: myaksrole_useraccess
  namespace: mynamespace
rules:
- apiGroups: [&quot;&quot;, &quot;extensions&quot;, &quot;apps&quot;]
  resources: [&quot;*&quot;]
  verbs: [&quot;create&quot;, &quot;patch&quot;, &quot;get&quot;, &quot;update&quot;, &quot;list&quot;]
- apiGroups: [&quot;batch&quot;]
  resources:
  - jobs
  - cronjobs
  verbs: [&quot;create&quot;, &quot;patch&quot;, &quot;get&quot;, &quot;update&quot;, &quot;list&quot;]
- apiGroups: [&quot;&quot;]
  resources:
  - pods
  verbs: [&quot;delete&quot;, &quot;create&quot;, &quot;patch&quot;, &quot;get&quot;, &quot;update&quot;, &quot;list&quot;]
</code></pre>
<p>Apply the changes:</p>
<pre><code>kubectl apply -f myaksrole_useraccess.yaml
</code></pre>
<p>Check the <code>myaksrole_useraccess</code> Role again:</p>
<pre><code>kubectl describe role myaksrole_useraccess -n mynamespace
Name:         myaksrole_useraccess
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
PolicyRule:
  Resources       Non-Resource URLs  Resource Names  Verbs
  ---------       -----------------  --------------  -----
  *               []                 []              [create patch get update list]
  *.apps          []                 []              [create patch get update list]
  cronjobs.batch  []                 []              [create patch get update list]
  jobs.batch      []                 []              [create patch get update list]
  *.extensions    []                 []              [create patch get update list]
  pods            []                 []              [delete create patch get update list]
</code></pre>
