<p>Below mentioned yaml file snippet is used for a role creation :
I am new in kubernetes and so looking for a reference link to elaborate the rules mentioned in the yaml . For example , my understanding is “” indicates core API groups of kubernetes and then my question is what is “extensions” for … Similarly for rest of the yaml looking for a reference / explanation. Thanks a lot guys for the help</p>

<pre><code>rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["*"]
  verbs: ["*"]
- apiGroups: ["batch"]
  resources:
  - jobs
  - cronjobs
  verbs: ["*"]
</code></pre>

RubenSo
<p>It is just a way of grouping k8s objects. As objects get added to k8s, they are added in a specific group.</p>

<p><code>core API group</code> is <strong>v1</strong>, so every time you see <code>apiVersion: v1</code>, such as <strong>Pod</strong> object, it is <code>core API group</code>. <code>replicaSet</code>, <code>Service</code> <code>ConfigMap</code>, <code>Node</code>, <code>secrets</code>, etc. are <strong>v1</strong> too. These are the main object k8s works with, that have been almost from the very beginning, and are solid (In my own words).</p>

<p>Objects can be moved from one group to another depending on their maturity. <code>Deployments</code>, for example, are now in <code>apps/v1</code> group, but they used to be in <code>extensions/v1beta1</code>. I, personally, have <code>yaml</code> files with the old group, that when I try to create, I get an error from the server. I think there was a period, when both <code>apps/v1</code> and <code>extentions/v1beta1</code> were valid. Not sure about this though.</p>

<p>K8s is an extensible platform, so you can also create your own objects through <code>CustomResourceDefinition</code>, and put them in a custom groups. This is the case of <strong>Ingress Controllers</strong>, <strong>Meshes</strong>, etc. Istio, for example creates bunch of objects, such as <code>Gateway</code>, <code>VirtualService</code>, <code>DestinationRule</code>, etc. Once you create this CDRs, you can get them with a normal <code>kubectl get gateway</code>, for example.</p>

<p><code>batch/v1</code> is for <strong>Jobs</strong>. I think there are no more objects in <code>batch/v1</code>. <strong>CronJobs</strong> are <code>batch/v1beta1</code>.</p>

<p>HorizontalPodAutoscaler is in <code>autoscaling/v1</code>.</p>

<p>Now, you don't really need to know these objects and their groups by heart. As the other answer says, you can always do <code>kubectl explain OBJECT</code> to know to which groups belongs an object. So a normal workflow for creating RBAC rules would be:</p>

<ol>
<li>What object do I want to manipulate the access control? -> Say jobs</li>
<li><code>kubectl explain jobs</code> -> And from here I will get that jobs are
batch/v1</li>
<li>I will create an RBAC rule for <code>batch</code>.</li>
</ol>

<p>The verbs are self explanatory.</p>

<p>Note that the group is only the first part; <code>batch</code>, <code>extensions</code>, "" (as v1 has nothing), etc.</p>

<p>There is more information about RBAC (like nonResourceURLs, for the paths that exposes api-server), but I think this should be enough to make a picture of how apiGroups work. Hope it helps.</p>
