<p>I want a deployment in kubernetes to have the permission to restart itself, from within the cluster.</p>
<p>I know I can create a serviceaccount and bind it to the pod, but I'm missing the name of the most specific permission (i.e. not just allowing <code>'*'</code>) to allow for the command</p>
<pre><code>kubectl rollout restart deploy &lt;deployment&gt;
</code></pre>
<p>here's what I have, and ??? is what I'm missing</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: restart-sa
---
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: restarter
rules:
  - apiGroups: [&quot;apps&quot;]
    resources: [&quot;deployments&quot;]
    verbs: [&quot;list&quot;, &quot;???&quot;]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: testrolebinding
  namespace: default
subjects:
  - kind: ServiceAccount
    name: restart-sa
    namespace: default
roleRef:
  kind: Role
  name: restarter
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  containers:
  - image: nginx
    name: nginx
  serviceAccountName: restart-sa
</code></pre>

<p>I believe the following is the minimum permissions required to restart a deployment:</p>
<pre><code>rules:
 - apiGroups: [&quot;apps&quot;, &quot;extensions&quot;]
   resources: [&quot;deployments&quot;]
   resourceNames: [$DEPLOYMENT]
   verbs: [&quot;get&quot;, &quot;patch&quot;]
</code></pre>
