<p>I am trying to create a Pod that is able to create and update a specific configmap using <code>Role.rules.resourceNames</code>. I am able to perform a get request for the resource to the API from within the pod, but I'm not able to create the resource, instead getting</p>
<pre><code>$ kubectl logs rbac-test
Error from server (Forbidden): error when creating &quot;/config/aaa.yaml&quot;: configmaps is forbidden: User &quot;system:serviceaccount:default:rbac-test&quot; cannot create resource &quot;configmaps&quot; in API group &quot;&quot; in the namespace &quot;default&quot;
</code></pre>
<p>If I remove the <code>resourceNames</code> attribute I am able to create the configmap, but I don't necessarily want this pod to be able to create and update configmaps willy-nilly. How can I restrict the serviceAccount's roles so that this pod can manipulate only the named configmap <code>aaa</code>?</p>
EDIT
<p>I got some help in the kubernetes slack (thank you, Alan). RBAC happens at the level of the URL so resourceName-restricted authorization can't happen for create URLs since there is no resource name in the URL!</p>
<pre class="lang-yaml prettyprint-override"><code>kind: Pod
apiVersion: v1
metadata:
  name: rbac-test
spec:
  restartPolicy: Never
  serviceAccountName: rbac-test
  imagePullSecrets:
    - name: docker-hub-creds 
  containers:
    - name: rbac-test
      image: bitnami/kubectl
      command: [ &quot;kubectl&quot; ]
      args: [ &quot;apply&quot;, &quot;-f&quot;, &quot;/config/aaa.yaml&quot; ]
      volumeMounts:
        - name: aaa-config
          mountPath: /config/
  volumes:
    - name: aaa-config
      configMap:
        name: aaa-config

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: aaa-config
data:
  aaa.yaml: |
    kind: ConfigMap
    apiVersion: v1
    metadata:
      name: aaa
    data:
      value: na

---
apiVersion: v1     
kind: ServiceAccount
metadata:
  name: rbac-test

---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: rbac-test
rules:
  - apiGroups: [ &quot;&quot; ]
    resources: [ &quot;configmaps&quot; ]
    verbs: [ &quot;get&quot;, &quot;create&quot;, &quot;update&quot; ]
    resourceNames: [ &quot;aaa&quot; ]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: rbac-test
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: rbac-test
subjects:
  - kind: ServiceAccount
    name: rbac-test
</code></pre>

littlebenlittle
<p>Note: You cannot restrict create or deletecollection requests by resourceName. For create, this limitation is because the object name is not known at authorization time.</p>
<p>Reference: <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/rbac/</a></p>
