<p>Here my first ServiceAccount, ClusterRole, And ClusterRoleBinding</p>
<pre><code>---
# Create namespace
apiVersion: v1
kind: Namespace
metadata:
  name: devops-tools
---
# Create Service Account
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: devops-tools
  name: bino

---
# Set Secrets for SA
# k8s &gt;= 1.24 need to manualy created
# https://stackoverflow.com/a/72258300
apiVersion: v1
kind: Secret
metadata:
  name: bino-token
  namespace: devops-tools
  annotations:
    kubernetes.io/service-account.name: bino
type: kubernetes.io/service-account-token

---
# Create Cluster Role
# Beware !!! This is Cluster wide FULL RIGHTS
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: devops-tools-role
  namespace: devops-tools
rules:
  - apiGroups:
        - &quot;&quot;
        - apps
        - autoscaling
        - batch
        - extensions
        - policy
        - networking.k8s.io
        - rbac.authorization.k8s.io
    resources:
      - pods
      - componentstatuses
      - configmaps
      - daemonsets
      - deployments
      - events
      - endpoints
      - horizontalpodautoscalers
      - ingress
      - jobs
      - limitranges
      - namespaces
      - nodes
      - pods
      - persistentvolumes
      - persistentvolumeclaims
      - resourcequotas
      - replicasets
      - replicationcontrollers
      - serviceaccounts
      - services
    verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;, &quot;update&quot;, &quot;patch&quot;, &quot;delete&quot;]
---
# Bind the SA to Cluster Role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: devops-tools-role-binding
subjects:
- namespace: devops-tools
  kind: ServiceAccount
  name: bino
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: devops-tools-role
---
</code></pre>
<p>It work when I use to create NameSpace, Deployment, and Service.
But it fail (complain about 'have no right') when I try to create kind: Ingress.</p>
<p>Then I try to add</p>
<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: devops-tools-role-binding-admin
subjects:
- namespace: devops-tools
  kind: ServiceAccount
  name: bino
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
</code></pre>
<p>and now 'bino' can do all things.</p>
<p>My question is: Is there any docs on what 'apiGroups' and 'resources' need to be assigned so one service account can do some-things (not all-things)?</p>
<p>Sincerely</p>
<p>-bino-</p>

Bino Oetomo
<p>You can run this command to determine the <code>apiGroup</code> of a resource:</p>
<pre><code>kubectl api-resources
</code></pre>
<p>You will see something like:</p>
<pre><code>NAME        SHORTNAMES    APIVERSION              NAMESPACED   KIND
ingresses   ing           networking.k8s.io/v1    true         Ingress
</code></pre>
<p>So you would need to add this to the <code>rules</code> of your <code>ClusterRole</code>:</p>
<pre><code>- apiGroups:
  - &quot;networking.k8s.io/v1&quot;
  resources:
  - &quot;ingresses&quot;
  verbs:
  - &quot;get&quot;
</code></pre>
