<p>I'm new to k8s.</p>

<p>I have a deployment with a single pod inside <code>k8test</code> (custom) namespace. <strong><em>for learning purposes</em></strong>, I want to give that pod an admin access.</p>

<p>I failed to achieve this by creating a namespace-role:</p>

<pre><code>    kind: 'Role',
    apiVersion: 'rbac.authorization.k8s.io/v1',
    metadata: {
      name: 'super-duper-admin',
      namespace: 'k8test',
    },
    rules: [
      {
        apiGroups: [''],
        resources: ['ResourceAll'],
        verbs: ['VerbAll'],
      },
    ],
</code></pre>

<p>from the pod`s log:</p>

<blockquote>
  <p>services is forbidden: User "system:serviceaccount:k8test:default" cannot list resource "services" in API group "" in the namespace "k8test"</p>
</blockquote>

<ul>
<li>I couldn't find a simple explanantion to what is <code>apiGroups</code>. What is it?</li>
</ul>

Stav Alfi
<p>You can find all api groups <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#-strong-api-overview-strong-" rel="nofollow noreferrer">here</a>. </p>

<p>As documented <a href="https://kubernetes.io/docs/reference/using-api/api-overview/#api-groups" rel="nofollow noreferrer">here</a></p>

<blockquote>
  <p>API groups make it easier to extend the Kubernetes API. The API group
  is specified in a REST path and in the apiVersion field of a
  serialized object</p>
</blockquote>

<p>Pod comes under <code>core</code> API Group and version <code>v1</code>. </p>

<p>In your RBAC <code>''</code> indicates the <code>core</code> API group.</p>

<p>Create the role as below which gives permission to all <code>apigroups</code>, all <code>resources</code> and all <code>verbs</code>.</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: k8test
  name: super-duper-admin
rules:
- apiGroups:
  - '*'
  resources:
  - '*'
  verbs:
  - '*'
</code></pre>

<p>Bind the role to the service account as below</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
# This role binding allows "jane" to read pods in the "default" namespace.
# You need to already have a Role named "pod-reader" in that namespace.
kind: RoleBinding
metadata:
  name: admin-rolebinding
  namespace: k8test
subjects:
# You can specify more than one "subject"
- kind: ServiceAccount
  name: default # "name" is case sensitive
  namespace: k8test
roleRef:
  # "roleRef" specifies the binding to a Role / ClusterRole
  kind: Role #this must be Role or ClusterRole
  name: super-duper-admin # this must match the name of the Role or ClusterRole you wish to bind to
  apiGroup: rbac.authorization.k8s.io
</code></pre>

<p>Execute below command to verify the RABC is properly applied </p>

<pre><code>kubectl auth can-i list services --as=system:serviceaccount:k8test:default -n k8test 
</code></pre>

<p>More information and examples about RBAC <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">here</a></p>
