<p>With security in mind, I do not want to allow the <code>create</code> verb on <code>Job</code> and <code>CronJob</code> resources because it would allow someone to create a pod (using any image) and expose sensitive information. But I also want to allow the ability to trigger jobs that have already been created on the cluster.</p>
<p>Is there a way to allow the triggering of <code>Jobs</code> and <code>CronJobs</code> in a Kubernetes cluster without assigning the <code>create</code> verb in a <code>Role</code> or <code>ClusterRole</code> RBAC definition?</p>
<p>If not, is there a way to only allow <code>create</code> when the <code>Job</code> or <code>CronJob</code> already exists on the cluster?</p>
<p>I've simply tried the following RBAC definition and was able to create any pod (dangerous) that I wanted.</p>
<pre><code>apiGroups:
  - batch
resources:
  - cronjobs
  - jobs
verbs:
  - get
  - create
</code></pre>

greenboi
<ol>
<li><p>You can't &quot;trigger&quot; a Job. A Job is either pending (waiting to run), running, or completed. If it's completed, you can't re-run it; you can only delete and re-create it.</p>
</li>
<li><p>The only way to manually run a CronJob is by...using it as a template to create a Job (<code>kubectl create job --from=cronjob ...</code>).</p>
</li>
</ol>
<p>So in both situations, you need the ability to <code>create</code> a <code>Job</code>.</p>
<p>Lastly:</p>
<ol>
<li>You can't &quot;allow create when the Job or CronJob already exists&quot;, because in that case the resource has already been created. There's nothing to create.</li>
</ol>
