<p>In the below manifest yaml:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-operator
rules:
- apiGroups: [apiextensions.k8s.io]
  resources: [customresourcedefinitions]
  verbs: ['*']
- apiGroups: [monitoring.coreos.com]
  resources: 
  - alertmanagers
  - prometheuses
  - prometheuses/finalizers
  - alertmanagers/finalizers
  - servicemonitors
  - prometheusrules
  verbs: ['*']
</code></pre>
<hr />
<p>What does <code>rules</code> with <code>apiGroups</code> signify?</p>

overexchange
<p>In Kubernetes resources can be either <code>grouped resources</code> or <code>individual resources</code> .</p>
<p>Example :</p>
<pre><code>kubectl api-resources  | grep 'crds\|pods\|NAME'
NAME                              SHORTNAMES   APIVERSION                             NAMESPACED   KIND
pods                              po           v1                                     true         Pod
customresourcedefinitions         crd,crds     apiextensions.k8s.io/v1                false        CustomResourceDefinition

</code></pre>
<p>In above output , for <code>pods</code> <code>apiVersion</code> is displayed as <code>v1</code> so it is an individual resource . where as for <code>customresourcedefinitions</code>  <code>apiVersion</code> is displayed as <code>apiextensions.k8s.io/v1</code> which indicates that it is a grouped resource under the group <code>apiextensions.k8s.io</code>.</p>
<p>When we are defining RBAC rules (roles/clusreroles) for grouped resources we need to mention <code>apiGroups</code> along with <code>resources</code>.</p>
