<p>The role <code>namespace-limited</code> should have full access to all resources (of the specified API groups) inside of a namespace. My Role manifest looks like this:</p>
<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: namespace-limited
  namespace: restricted-xample
rules:
- apiGroups:
  - core
  - apps
  - batch
  - networking.k8s.io
  resources: [&quot;*&quot;] # asterisk to grant access to all resources of the specified api groups
  verbs: [&quot;*&quot;]
</code></pre>
<p>I associated the Role to a ServiceAccount using a RoleBinding but unfortunately this ServiceAccount has no access to <code>Pod</code>, <code>Service</code>, <code>Secret</code>, <code>ConfigMap</code> and <code>Endpoint</code> Resources. These resources are all part of the <code>core</code> API group. All the other common Workloads work though. Why is that?</p>

Tom Böttger
<p>The core group, also referred to as the legacy group, is at the REST path <code>/api/v1</code> and uses <code>apiVersion: v1</code></p>
<p>You need to use <code>&quot;&quot;</code> for core API group.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: restricted-xample
  name: namespace-limited
rules:
- apiGroups: [&quot;&quot;, &quot;apps&quot;, &quot;batch&quot;, &quot;networking.k8s.io&quot;] # &quot;&quot; indicates the core API group
  resources: [&quot;*&quot;]
  verbs: [&quot;*&quot;]
</code></pre>
<p>To test the permission of the service account use below commands</p>
<pre><code>kubectl auth can-i get pods --as=system:serviceaccount:restricted-xample:default -n restricted-xample 
kubectl auth can-i get secrets --as=system:serviceaccount:restricted-xample:default -n restricted-xample 
kubectl auth can-i get configmaps --as=system:serviceaccount:restricted-xample:default -n restricted-xample
kubectl auth can-i get endpoints --as=system:serviceaccount:restricted-xample:default -n restricted-xample 
</code></pre>
