<p>In my k3s cluster, I am editing a <code>Role</code> to add permission to a resource e.g. <code>deployment</code>.</p>
<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  creationTimestamp: &quot;2023-09-02T08:00:23Z&quot;
  name: foo
  namespace: default
  resourceVersion: &quot;432595&quot;
  uid: 603d0e0b-62f8-4e46-a42c-66436203bdc9
rules:
- apiGroups:
  - apps. # I know API Group is 'apps' but I wonder how to figure it out in general
  resources:
  - deployments
  verbs:
  - get
  - list
  - watch
</code></pre>
<p>In the <code>apiGroups</code> field above, I know the API group for <code>deployment</code> resource is <code>app</code> based on my googling.</p>
<p>But I wonder in general how can I figure out which API group certain resource belongs to using <code>kubectl</code> command?</p>
<p>For example, I know also there is <code>kubectl api-resources</code> command, but if I run it for <code>deployment</code> resource as an example:</p>
<pre><code>k api-resources | grep 'deployment'
NAME            SHORTNAMES   APIVERSION   NAMESPACED   KIND
deployments     deploy       apps/v1      true         Deployment
</code></pre>
<p>The output tells me the <code>APIVERSION</code> is <code>apps/v1</code>.  But what exactly is the <strong>API Group</strong> when I see value of <code>apps/v1</code>? Should I consider the value of <code>APIVERSION</code> is the API Group of this resource or is it always the left side of <code>/</code> be the API group?</p>
<p>Could someone please clarify for me? Thank you.</p>

user842225
<p>Yes, you can consider that the left side of the <code>/</code> is always the apiGroup. <code>app/v1</code> indicates the <strong>REST API path</strong>, in general the api path looks like <code>/apis/$GROUP\_NAME/$VERSION</code> where app is the <a href="https://kubernetes.io/docs/reference/using-api/#api-groups" rel="nofollow noreferrer"><strong>apiGroup</strong></a> and <strong>v1</strong> is the <strong>apiVersion.</strong></p>
<p>There is one exception though, if you are using components from <strong>core group</strong> or <strong>legacy group</strong>, the definition looks like <code>apiVersion: v1</code> instead of <code>apiVersion: core/v1</code>.</p>
<p>When we are trying to use a particular object, let's say <code>role</code> in your example, we can go through the official documentation of that particular component or you can also go through the <strong><a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/" rel="nofollow noreferrer">api reference documentation</a></strong> for finding the <strong>apiGroup</strong> of that object.</p>
