<p>Based on this documentation - <a href="https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengaboutaccesscontrol.htm" rel="nofollow noreferrer">https://docs.cloud.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengaboutaccesscontrol.htm</a> I am trying to configure access to Kubernetes for an Oracle Cloud IAM group, but I can only successfully grant access for individual users.</p>

<p>Steps to reproduce (assumes compartment, cluster, OCI CLI and kubectl configured):</p>

<ul>
<li>Create an IAM group - <code>testgroup</code></li>
<li>Create an IAM user - <code>testuser</code></li>
<li>Put the user <code>testuser</code> into the group <code>testgroup</code></li>
<li>Create a Policy in your compartment - <code>kubernetes_dev_access</code></li>
<li>Policy statement - <code>Allow group testgroup to use clusters in compartment mycompartment</code></li>
<li>Apply the following Kubernetes manifest :</li>
</ul>

<pre><code>---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubernetes_dev_access
rules:
- apiGroups: [""]
  resources: ["pods", "services"]
  verbs: ["create", "get", "update", "list", "delete", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["create", "get", "update", "list", "delete", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: kubernetes_dev_access_group
subjects:
- kind: Group
  name: ocid1.group.oc1..aaaaaaaaabababababababababababababababababa
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: kubernetes_dev_access
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>This should allow my user successfully list the pods :</p>

<pre><code>kubectl get pods
</code></pre>

<p>But I get the following error :</p>

<pre><code>Error from server (Forbidden): pods is forbidden: User "ocid1.group.oc1..aaaaaaaaabababababababababababababababababa" cannot list resource "pods" in API group "" in the namespace "mynamespace"
</code></pre>

<p>The crucial lines seem to be :</p>

<pre><code>- kind: Group
  name: ocid1.group.oc1..aaaaaaaaabababababababababababababababababa
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>If I replace these lines with the following reference to the specific user it works, ie I get the list of pods :</p>

<pre><code>- kind: User
  name: ocid1.user.oc1..aaaaaaaaaxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyxyx
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>Any pointers gratefully appreciated, thanks.</p>

Alex D.
<p>OKE supports groups in RBAC for at least several months now. So your code should work now.</p>
