<p>I have the following role:</p>

<p><code>roleRef:
    apiGroup: rbac.authorization.k8s.io
    kind: ClusterRole
    name: admin</code> </p>

<p>When I do a <code>kubectl proxy --port 8080</code> and then try doing</p>

<p><code>http://127.0.0.1:8080/apis/extensions/v1beta1/namespaces/cdp/deployments/{deploymentname}</code></p>

<p>I get a <code>200</code> and everything works fine. However when I do:</p>

<p><code>http://127.0.0.1:8080/apis/extensions/v1beta1/namespaces/cdp/deployments/{deploymentname}/status</code></p>

<p>I get forbidden and a <code>403</code> status back . </p>

<p>I also am able to do <code>get</code>, <code>create</code>, <code>list</code>,<code>watch</code> on deployments with my <code>admin</code> role .  </p>

<p>Any idea as to why <code>/status</code> would give forbidden when I clearly have all the necessary permission as admin for my namespace. </p>

Dipayan
<p>You mentioned verbs of the role and you didn't mention resources and apiGroup. Make sure the following are set:</p>

<pre><code>  - apiGroups:
    - apps
    - extensions
    resources:
    - deployments/status
</code></pre>
