<p>Does the role below allow getting the contents of all secrets in the <code>bar</code> namespace, or just the secret named <code>foo</code>? I don't understand what the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb" rel="nofollow noreferrer">docs</a> mean by</p>
<blockquote>
<p>list (for collections, including full object content)</p>
</blockquote>
<p>What does &quot;full object content&quot; mean in this context?</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: fooer
  namespace: bar
rules:
  - apiGroups: [&quot;&quot;]
    resources: [secrets]
    verbs: [list]
  - apiGroups: [&quot;&quot;]
    resources: [secrets]
    verbs: [get, watch]
    resourceNames: [&quot;foo&quot;]
</code></pre>
<p>Thank you</p>

user2133814
<p>A role is specific to a <code>namespace</code>. So the yaml actually should look like</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1beta1
kind: Role
metadata:
  name: role
  namespace: default
rules:
  - apiGroups: [&quot;&quot;]
    resources: [secrets]
    verbs: [list]

---

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: role-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: role
subjects:
- kind: ServiceAccount
  name: default
  namespace: default
</code></pre>
<p>For collections(secrets for example) <code>list</code> means permission on all the resources together coming under the list. Because of that you can get all secrets with the above role using below command</p>
<pre><code>kubectl get secrets --as=system:serviceaccount:default:default -n default -o yaml
</code></pre>
<p>but you can not get each secret individually using</p>
<pre><code>kubectl get secrets/default-token-bwk2x --as=system:serviceaccount:default:default -n default -o yaml
Error from server (Forbidden): secrets &quot;default-token-bwk2x&quot; is forbidden: User &quot;system:serviceaccount:default:default&quot; cannot get resource &quot;secrets&quot; in API group &quot;&quot; in the namespace &quot;default&quot;
</code></pre>
<p><em><strong>Including full object content</strong></em> means the content of all the objects together coming under that list as you can see using the first command above.</p>
<blockquote>
<p>Does kubernetes list permissions allow getting individual objects in
the collection</p>
</blockquote>
<p>No, It does not. You can only get full aggregated content of all the items in the list but not the content of each item individually.</p>
