<pre><code>apiVersion: rbac.authorization.k8s.io/v1                                                                                                                    
kind: Role                                                                                                                                                  
metadata:                                                                                                                                                   
  name: p-viewer-role                                                                                                                  
  namespace: pepsi                                                                                                                                  
rules:                                                                                                                                                      
- apiGroups:                                                                                                                                                
  - ""                                                                                                                                    
  resourceNames:                                                                                                                                            
  - p83                                                                                                                                                     
  resources:                                                                                                                                                
  - pods                                                                                                                                                
  verbs:                                                                                                                                                    
  - list                                                                                                                                                    
  - get                                                                                                                                                     
  - watch   
</code></pre>

<p>When we use resourceNames in the Roles, the following command works</p>

<pre><code>kubectl get pods -n pepsi p83
</code></pre>

<p>returns a proper value. However, </p>

<pre><code>kubectl get pods -n pepsi 
</code></pre>

<p>returns forbidden. Why doesn't it list p83 </p>

<h2>RoleBinding</h2>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1                                                                                                                    
kind: RoleBinding                                                                                                                                           
metadata:                                                                                                                                                   
  name: p-viewer-rolebinding                                                                                                          
  namespace: pepsi                                                                                                                                  
roleRef:                                                                                                                                                    
  apiGroup: rbac.authorization.k8s.io                                                                                                                       
  kind: Role                                                                                                                                                
  name: p-viewer-role                                                                                                                  
subjects:                                                                                                                                                   
- apiGroup: rbac.authorization.k8s.io                                                                                                                       
  kind: Group                                                                                                                                               
  name: pepsi-project-viewer                                                                                                                    
  namespace: project                                                                                                                      
</code></pre>

<p>This is expected behavior. You have defined a <code>role</code> which is scoped to the <code>namespace</code> pepsi to <code>pod</code> <code>resources</code> with specific <code>resourceName</code> <code>p83</code>.</p>

<p>For <code>kubectl get pods -n peps</code> command to work you need to remove the <code>resourceNames</code> <code>p83</code> from the <code>Role</code></p>

<p>This kind of advanced validation is best handled by <a href="https://www.openpolicyagent.org" rel="noreferrer">OPA</a> where you can define fine grained policies.</p>
