<p>I am following a tutorial regarding RBAC, I think I understand the main idea but I don't get why this is failing:</p>
<pre class="lang-sh prettyprint-override"><code>kc auth can-i &quot;*&quot; pod/compute --as deploy@test.com
no

kc create clusterrole deploy --verb=&quot;*&quot; --resource=pods --resource-name=compute
clusterrole.rbac.authorization.k8s.io/deploy created

kc create clusterrolebinding deploy --user=deploy@test.com --clusterrole=deploy
clusterrolebinding.rbac.authorization.k8s.io/deploy created

# this tells me that deploy@test.com should be able to create a pod named compute
kc auth can-i &quot;*&quot; pod/compute --as deploy@test.com
yes

# but it fails when trying to do so
kc run compute --image=nginx --as deploy@test.com
Error from server (Forbidden): pods is forbidden: User &quot;deploy@test.com&quot; cannot create resource &quot;pods&quot; in API group &quot;&quot; in the namespace &quot;default&quot;

</code></pre>
<p>the namespace name should be irrelevant afaik, since this is a clusterrole.</p>

Simon Ernesto Cardenas Zarate
<p>Restricting the <code>create</code> permission to a specific resource name is not supported.</p>
<p>This is from the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources" rel="nofollow noreferrer">Kubernetes documentation</a>:</p>
<blockquote>
<p>Note: You cannot restrict create or deletecollection requests by resourceName. For create, this limitation is because the object name is not known at authorization time.</p>
</blockquote>
<p>This means the <code>ClusterRole</code> you created doesn't allow you to create any Pod.
You need to have another <code>ClusterRole</code> assigned where you don't specify the resource name.</p>
