<p>I'm trying to give a group of users permission to scale a specific set of deployments in kubernetes 1.20</p>
<p>I've tried using the API reference doc here: <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#patch-scale-deployment-v1-apps" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.20/#patch-scale-deployment-v1-apps</a>
to set resource names like so:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeoperator-cr
rules:
... #irrelevant rules omitted
- apiGroups: [&quot;apps&quot;]
  resources:
    - /namespaces/my-namespace-name/deployments/my-deployment-name/scale
    - deployments/my-deployment-name/scale
  verbs:
    - update
    - patch
</code></pre>
<p>This doesn't work:</p>
<pre><code>$ kubectl scale deployments -n my-namespace-name my-deployment-name --replicas 3
Error from server (Forbidden): deployments.apps &quot;my-deployment-name&quot; is forbidden: User &quot;kubeoperatorrole&quot; cannot patch resource &quot;deployments/scale&quot; in API group &quot;apps&quot; in the namespace &quot;my-namespace-name&quot;
</code></pre>
<p>The only way I can get the scale command to work is to grant the permission for all deployments (which is <strong>not</strong> what I want) like this:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeoperator-cr
rules:
... #irrelevant rules omitted
- apiGroups: [&quot;apps&quot;]
  resources:
    - deployments/scale
  verbs:
    - update
    - patch
</code></pre>
<pre><code>$ kubectl scale deployments -n my-namespace-name my-deployment-name --replicas 3
deployment.apps/my-deployment-name scaled
</code></pre>
<p>What is the correct syntax for specifying a specific deployment resource by name, or is this not possible?
The deployments I'm targeting cannot be moved to an isolated namespace.</p>

conmanworknor
<p>Try:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kubeoperator-cr
rules:
- apiGroups: [&quot;apps&quot;]
  resources:
  - deployments/scale
  resourceNames: [&quot;my-deployment-name&quot;]  # &lt;-- name of your deployment here
  verbs:
  - update
  - patch
</code></pre>
