<p>I cannot for the life of me find a detailed table of what all the Kubernetes RBAC verbs do. The only resource I see people recommending is <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#determine-the-request-verb" rel="nofollow noreferrer">this one</a>, which is <em>woefully</em> inadequate.</p>
<p>So I've been working it out by experimentation.</p>
<p>Most are fairly straightforward so far, except for <code>UPDATE</code>. This does not seem to be able to do <em>anything</em> I would expect it to.</p>
<p><strong>Permissions I gave my alias:</strong>
[<code>GET</code>, <code>UPDATE</code>] on [<code>deployments</code>] in <code>default</code> namespace.</p>
<p><strong>Things I've tried:</strong></p>
<ul>
<li><code>kubectl set image deployment/hello-node echoserver=digitalocean/flask-helloworld --as user</code></li>
<li><code>kubectl edit deploy hello-node --as user</code></li>
<li><code>kubectl apply -f hello-node.yaml --as eks-user</code></li>
</ul>
<p>These all failed with error: <code>deployments.apps &quot;hello-node&quot; is forbidden: User &quot;user&quot; cannot patch resource &quot;deployments&quot; in API group &quot;apps&quot; in the namespace &quot;default&quot;</code></p>
<p>I then tried some rollout commands like:</p>
<ul>
<li><code>k rollout undo deploy hello-node --as user</code></li>
</ul>
<p>But they failed because I didn't have replica-set access.</p>
<hr />
<p><strong>TLDR:</strong> What is the point of the Kubernetes RBAC <code>update</code> verb?</p>
<p>For that matter, does anyone have a more detailed list of all RBAC verbs?</p>

Hebe Hilhorst
<p>Following up this, I went to the Kubernetes <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.19/" rel="noreferrer">REST API documentation</a>, which has a long list of all the HTTP API calls you can make to the REST server.</p>
<p>I thought this would help because the one (1) table available describing what the different verbs can do did so by comparing them to HTTP verbs. So the plan was:</p>
<ol>
<li>See what HTTP verb the <code>update</code> permission is equated to.</li>
<li>Go to the reference and find an example of using that HTTP verb on a deployment.</li>
<li>Test the <code>kubectl</code> equivalent.</li>
</ol>
<p>So.</p>
<p><strong>What HTTP verb equals the <code>update</code> permission?</strong></p>
<p><code>PUT</code>.</p>
<p><strong>Example of using <code>PUT</code> for deployments?</strong></p>
<blockquote>
<p>Replace Scale: replace scale of the specified Deployment</p>
</blockquote>
<blockquote>
<p>HTTP Request
<code>PUT /apis/apps/v1/namespaces/{namespace}/deployments/{name}/scale</code></p>
</blockquote>
<p><strong>What's the equivalent <code>kubectl</code> command?</strong></p>
<p>Well we're scaling a deployment, so I'm going to say:</p>
<pre><code>kubectl scale deployment hello-node --replicas=2
</code></pre>
<p><strong>Can I run this command?</strong></p>
<p>I extended my permissions to <code>deployment/scale</code> first, and then ran it.</p>
<pre><code>Error from server (Forbidden): deployments.apps &quot;hello-node&quot; is forbidden: User &quot;user&quot; cannot patch resource &quot;deployments/scale&quot; in API group &quot;apps&quot; in the namespace &quot;default&quot;
</code></pre>
<p>Well. That also needs <code>patch</code> permissions, it would appear.</p>
<p>Despite the fact that the HTTP verb used is <strong><code>PUT</code></strong> according to the API docs, and <code>PUT</code> is equivalent to <code>update</code> according to the one (1) source of any information on these RBAC verbs.</p>
<p>Anyway.</p>
<p><strong>My Conclusion:</strong> It appears that <code>update</code> is indeed pretty useless, at least for Deployments.</p>
<p>The RBAC setup seemed promising at first, but honestly it's starting to lose its lustre as I discover more and more edge cases and undocumented mysteries. Access permissions seem like the absolute worst thing to be vague about, or your security ends up being more through obscurity than certainty.</p>
