<p>For example, I want to create a role without &quot;get&quot;, &quot;list&quot; or &quot;watch&quot; resource &quot;pod&quot; permissions. Is there any convenient way to quickly create this rule?</p>
<pre><code>rules:
- apiGroups: [&quot;&quot;]
  #
  # at the HTTP level, the name of the resource for accessing Pod
  # objects is &quot;pods&quot;
  resources: [&quot;pods&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;]
</code></pre>

Anur Sakurakouji
<p>No, roles are purely additive, <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole" rel="nofollow noreferrer">there are no deny rules</a>.</p>
<p>In the ticket <a href="https://github.com/kubernetes/kubernetes/issues/85963" rel="nofollow noreferrer">Add Support to Deny RBAC Rules #85963</a> there is lots of discussions around this. The issue was eventually <a href="https://github.com/kubernetes/kubernetes/issues/85963#issuecomment-708403412" rel="nofollow noreferrer">closed with the follwoing rationale</a></p>
<blockquote>
<p>This is unlikely to make progress as an issue. While there is clear
interest, deny rules were considered and decided against during
development of RBAC because of the complexity, implications to
upgrades, and unclear superuser/non-superuser interactions.</p>
</blockquote>
