<p>I my 1.9 cluster created this deployment role for the dev user. Deployment works as expected. Now I want to give exec and logs access to developer. What role I need to add for exec to the pod?</p>

<pre><code>kind: Role
name: deployment-manager
  rules:
  - apiGroups: ["", "extensions", "apps"]
    resources: ["deployments", "replicasets", "pods"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
</code></pre>

<p>Error message:</p>

<pre><code>kubectl exec nginx -it -- sh  

Error from server (Forbidden): pods "nginx" is forbidden: User "dev" cannot create pods/exec in the namespace "dev"
</code></pre>

<p>Thanks
SR</p>

<p>The <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources" rel="nofollow noreferrer">RBAC docs say that</a></p>
<blockquote>
<p>Most resources are represented by a string representation of their name, such as “pods”, just as it appears in the URL for the relevant API endpoint. However, some Kubernetes APIs involve a “subresource”, such as the logs for a pod. [...] To represent this in an RBAC role, use a slash to delimit the resource and subresource.</p>
</blockquote>
<p>To allow a subject to read both pods and pod logs, and be able to exec into the pod, you would write:</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: pod-and-pod-logs-reader
rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;, &quot;pods/log&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;]
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods/exec&quot;]
  verbs: [&quot;create&quot;]
</code></pre>
<p>Some client libraries may do an http GET to negotiate a websocket first, which would require the &quot;get&quot; verb. kubectl sends an http POST instead, that's why it requires the &quot;create&quot; verb in that case.</p>
