<p>I am trying to delete <a href="https://github.com/tektoncd/pipeline" rel="nofollow noreferrer">tekton</a> kubernetes resources in the context of a service account with an on-cluster kubernetes config, and am experiencing errors specific to accessing <code>deletecollection</code> with all tekton resources. An example error is as follows:</p>
<blockquote>
<p>pipelines.tekton.dev is forbidden: User &quot;system:serviceaccount:my-account:default&quot; cannot deletecollection resource &quot;pipelines&quot; in API group &quot;tekton.dev&quot; in the namespace &quot;my-namespace&quot;</p>
</blockquote>
<p>I have tried to apply <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> to help here, but continue to experience the same errors. My RBAC attempt is as follows:</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: my-role
  namespace: my-namespace
rules:
- apiGroups: [&quot;tekton.dev&quot;]
  resources: [&quot;pipelines&quot;, &quot;pipelineruns&quot;, &quot;tasks&quot;, &quot;taskruns&quot;]
  verbs: [&quot;get&quot;, &quot;watch&quot;, &quot;list&quot;, &quot;delete&quot;, &quot;deletecollection&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: my-role-binding
  namespace: my-namespace
subjects:
- kind: User
  name: system:serviceaccount:my-account:default
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: my-role
  apiGroup: rbac.authorization.k8s.io
</code></pre>
<p>These RBAC configurations continue to result in the same error. Is this, or similar necessary? Are there any examples of RBAC when interfacing with, specifically deleting, tekton resources?</p>

scniro
<p>Given two namespaces <code>my-namespace</code> and <code>my-account</code> the default service account in the <code>my-account</code> namespace is correctly granted permissions to the <code>deletecollection</code> verb on <code>pipelines</code> in <code>my-namespace</code>.</p>
<p>You can verify this using <code>kubectl auth can-i</code> like this after applying:</p>
<pre><code>$ kubectl -n my-namespace --as=&quot;system:serviceaccount:my-account:default&quot; auth can-i deletecollection pipelines.tekton.de
yes
</code></pre>
<p>Verify that you have actually applied your RBAC manifests.</p>
